Jak se zbavit PrivateContent? - VYŘEŠENO Vyřešeno

[thirty-six]

zdravim,
podarilo se mi nainstalovat do pc PrivateContent.exe tzn., ze pri otevirani web stranek se mi nahodne zablokujou a naskakuje jakysi overovaci kod pro odblokovani stranky + objevujou se reklamy. jak se toho zbavit? dik za pomoc.

posilam logy z hjthis a combofix:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:50:07, on 18.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\oodag.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\OO Software\CleverCache\ooccag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Vlastník\Plocha\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4D91-8333-CF10577473F7} - C:\Documents and Settings\Vlastník\Google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
O23 - Service: plasservice (ZeppelinService) - ParetoLogic Inc. - C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe

--
End of file - 7788 bytes


*************
COMBOFIX
*************

ComboFix 09-06-17.02 - Vlastník 18.06.2009 1:20.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1535.1074 [GMT 2:00]
Spuštěný z: c:\documents and settings\Vlastník\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Vlastník\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\windows\system32\drivers\Partizan.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Vlastník\Plocha\pája2\RECTICEL\company document\28??????(07.07.25???\_desktop.ini
c:\documents and settings\Vlastník\Plocha\pája2\RECTICEL\NINGBO 3\Jason comp\company document\28??????(07.07.25???\_desktop.ini

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-17 do 2009-06-17 )))))))))))))))))))))))))))))))
.

2009-06-16 20:38 . 2009-06-16 20:41 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-06-16 19:07 . 2009-06-16 20:04 -------- d-----w- c:\program files\Common Files\WhenU
2009-06-16 19:06 . 2009-06-16 20:05 -------- d-----w- c:\program files\DAEMON Tools SearchBar
2009-06-16 19:06 . 2009-06-16 19:07 -------- d-----w- c:\program files\DaemonTools_WhenUSave_Installer
2009-06-16 18:50 . 2009-06-16 18:50 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-07 22:10 . 2009-06-07 22:10 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2009-06-07 20:34 . 2009-06-07 19:56 39200 ----a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-06-07 20:34 . 2009-06-07 19:54 33056 ----a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-06-07 20:34 . 2009-06-07 19:52 12576 ----a-w- c:\windows\system32\drivers\TfKbMon.sys
2009-06-07 20:34 . 2009-06-07 19:52 51488 ----a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-06-07 18:31 . 2008-12-11 06:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-07 18:31 . 2009-06-07 19:48 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-07 18:31 . 2008-12-18 10:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-07 18:31 . 2009-06-07 18:31 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-07 18:31 . 2008-12-10 10:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-07 18:31 . 2009-06-15 20:45 -------- d-----w- c:\program files\Spyware Doctor
2009-06-04 18:38 . 2009-06-04 18:50 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-06-04 18:37 . 2009-06-07 15:01 -------- d-----w- c:\windows\Internet Logs
2009-06-04 14:24 . 2009-06-04 14:24 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-06-04 14:24 . 2009-06-04 14:24 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-06-04 14:24 . 2009-06-04 14:24 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-06-04 14:24 . 2009-06-04 14:24 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-06-04 14:19 . 2009-06-07 14:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-03 20:44 . 2009-06-07 14:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 17:54 . 2009-06-07 14:59 -------- d-----w- c:\program files\Lavasoft
2009-06-03 17:00 . 2009-06-03 17:00 -------- d-----w- c:\program files\CZshare
2009-06-03 16:15 . 2009-06-07 14:58 -------- d-----w- c:\program files\XoftSpySE
2009-06-02 16:42 . 2009-06-07 14:53 -------- d-----w- c:\program files\Anti Trojan Elite
2009-06-02 16:10 . 2009-06-02 16:10 32480 ----a-w- c:\windows\system32\Partizan.exe
2009-06-02 15:37 . 2009-06-17 23:24 8762912 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-02 15:37 . 2009-06-17 23:03 212768 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-02 15:26 . 2009-06-03 17:45 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-06-02 15:26 . 2009-06-03 17:44 -------- d-----w- c:\program files\ParetoLogic

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-17 23:03 . 2009-06-02 15:37 18608 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-17 23:03 . 2009-06-02 15:37 119396 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-07 14:54 . 2007-12-09 11:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-04 18:21 . 2008-03-26 10:25 823 ----a-w- c:\windows\win.tmp
2009-05-20 11:12 . 2007-12-05 16:17 -------- d-----w- c:\program files\Sony Ericsson
2009-05-20 11:12 . 2007-12-05 16:17 -------- d-----w- c:\program files\Common Files\Teleca Shared
2009-05-20 11:07 . 2007-11-14 16:06 -------- d-----w- c:\program files\Testy Autoškola
2009-05-08 08:43 . 2009-05-08 08:42 -------- d-----w- c:\program files\Alchemy Mindworks
2009-05-07 22:23 . 2008-09-04 21:37 -------- d-----w- c:\program files\SpeedFan
2009-05-07 21:41 . 2009-05-07 21:41 -------- d-----w- c:\program files\VeryPDF PDF2Word v3.0
2009-05-07 21:07 . 2009-05-07 21:07 279998 ----a-w- c:\windows\Icon Converter Plus Uninstaller.exe
2009-05-07 21:07 . 2009-05-07 21:07 -------- d-----w- c:\program files\Icon Converter Plus
2009-05-07 19:06 . 2008-08-13 20:55 -------- d-----w- c:\program files\IrfanView
2009-05-07 15:44 . 2004-08-17 13:49 345088 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:53 . 2004-08-17 13:49 660480 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:53 . 2004-08-17 13:49 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 20:11 . 2004-08-17 13:44 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-16 21:08 . 2001-10-25 12:00 74876 ----a-w- c:\windows\system32\perfc005.dat
2009-04-16 21:08 . 2001-10-25 12:00 403596 ----a-w- c:\windows\system32\perfh005.dat
2009-04-15 15:18 . 2004-08-17 13:49 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2004-10-01 13:00 . 2007-10-01 20:23 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-08-08 2610608]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-21 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"ooccctrl.exe"="c:\program files\OO Software\CleverCache\ooccctrl.exe" [2007-01-28 1911568]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-12-7 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{51C55F9E-C308-4c95-89AB-8858D8AFD819}"= "c:\program files\ParetoLogic\Anti-Spyware\PASShlExt.dll" [2007-03-29 98304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0Partizan\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [7.6.2009 20:31 130936]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [7.6.2009 22:34 51488]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [7.6.2009 22:34 39200]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [7.6.2009 20:31 159600]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 15:00 15872]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 9:21 468224]
R2 ZeppelinService;plasservice;c:\program files\Common Files\ParetoLogic\PLAS\plasservice.exe [18.2.2009 14:40 587216]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [5.12.2007 18:45 13352]
S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [7.6.2009 20:31 64392]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [7.6.2009 20:31 348752]
S3 se46bus;Sony Ericsson Device 070 driver (WDM);c:\windows\system32\drivers\se46bus.sys [5.12.2007 18:35 61536]
S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter;c:\windows\system32\drivers\se46mdfl.sys [5.12.2007 18:35 9360]
S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver;c:\windows\system32\drivers\se46mdm.sys [5.12.2007 18:35 97088]
S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\se46mgmt.sys [5.12.2007 18:41 88624]
S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS);c:\windows\system32\drivers\se46nd5.sys [5.12.2007 18:41 18704]
S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface;c:\windows\system32\drivers\se46obex.sys [5.12.2007 18:40 86432]
S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM);c:\windows\system32\drivers\se46unic.sys [5.12.2007 18:41 90800]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [7.6.2009 22:34 33056]
S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-05-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2009-06-03 c:\windows\Tasks\ParetoLogic Anti-Spyware.job
- c:\program files\ParetoLogic\Anti-Spyware\Pareto_AS.exe [2007-04-17 14:40]

2009-06-02 c:\windows\Tasks\ParetoLogic Anti-Virus PLUS.job
- c:\program files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.exe [2009-02-18 12:43]

2009-06-09 c:\windows\Tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job
- c:\program files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.exe [2009-02-18 12:43]

2009-06-09 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 10:25]

2009-06-17 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 10:25]

2009-06-17 c:\windows\Tasks\ParetoLogic Update.job
- c:\program files\Common Files\ParetoLogic\UUS\Pareto_Update.exe [2007-04-11 11:39]

2009-06-17 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-31 20:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - c:\windows\system32\fmrsslink.dll/201
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
LSP: c:\windows\system32\INetHTTPFilter.dll
FF - ProfilePath -

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-18 01:24
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):32,29,af,f1,c9,bf,ad,21,b3,01,ff,09,3f,8c,b2,1e,74,27,ca,5f,e6,
56,05,2d,da,bf,70,54,a7,a9,e6,55,1f,04,5c,f9,41,f5,3e,60,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{6ea73178-4a5b-4344-99b9-3315bb61734b}]
@Denied: (Full) (Everyone)
"Model"=dword:00000001
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):76,8f,cb,8b,cc,98,f5,7e,ba,bd,45,f2,a9,ce,7f,5b,34,83,62,11,83,
f6,72,f7,b7,80,f5,68,7c,78,14,18,27,23,ca,61,56,67,c7,26,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{b479778b-32c3-4501-a289-542d8126d0ce}]
@Denied: (Full) (Everyone)
"Model"=dword:0000007d
"Therad"=dword:0000001e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,07,f3,08,32,3e,19,f6,d1,36,1e,bd,9f,03,55,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="80EA413A62D875761803D9B92F12D7E16E422F86570865B2B658B99088286EAD6985DA52E8CD0B21F7DE846DB554DA05E2A6A658BD3CA2360F40ED9EA05C36BCF31FD72DE5A4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA6A0AC4980AC7933A6A0AC4980AC7933A7E04BA9E8C23738390AA8B2DF4BEB5F4D2325A8FE167C24C46189F05BA8859930444F314F88BDD0335EC94C0D038E9BBC2B266FFD0F71DF15F1B4A9F43DACF7AFC186172BB1D0A75A72D91B1339119D2EBED82CFB5FE7055F6B222D7BA388AB507B28D533B627AC7DF6DC3260C68A3D34422DAABA5FF2779C03501DA658CBBF8E9AE0083552B1353FA64C45F44848B9B71E8B58902DDCFB1971B341C2175BA33D47D16C918212F898BB942D679D48B1F23ECBC6E729A03E77F432842DE3D0AA02308EE83C0C1F94D17518E75FEA3EADF7163DABBFF8F04CAACE28755A04798C57891D053D7462890999AA159B989295A8962161A906B0187D45E247510257E40A09FB6CB1889BB9346C9679ECD2DFB63D3BAEE54B7CF7F68AA126502EAB2033BB691A6E48D53DEE973D967EB709F5C2427F0FDAE0CD15A5C2B1288D1E933CD963E8DBFE46316CD6CF58DDB1F5EFD7CE96E3DF0636B007C1ECC5959A6610CA22C9CB18370430857FC99491C236003ED46D6D33512F1B824DA0B68CBD5D3A1CB48C569C52ED2F175F4947480818759331512590CA414E70AEC95A9F5AEEF1B5A31DD529AF04CCE04D644C9178514FF8269A9670A5F7486D312A91577E1A5752DFC396F0535A6CDC860784ED33AAD140D8FAD34135EF4E4A02563B2DD672D1DD4317EB1C66193534ABEED2D0F6030671D2757065F4DC6B8BB336BF90381E0CFA0807AD46B2FC9144C0AF9E25AA49B84781E285B20384EBE7BC0907E39859F27ECD54B501AAD6B121AC2FD447D50578B337EDAEF2204160CDF8DC7E8092F238F29795E1CE5F0A8890BEA9E288264E1AD727178EE4B3819E5EA4189830E44FD3164DB416A88B8F4C0EA5ABBEADEBD2B60CECB149B9C6463FEBE3F24B3073E47FD6B96DB7790972F847F59A5EEE9CD2A85C83E5069787272080BB7A8F3644BD385D8C5333A2D7D34D9E282B3EFA502590874FAFF19946CD61D8188F63E782FA4182D8CBF4779DE7CDAA1AE8DE70C433538114DDBE4C7B7969E346E548DFFC4F9FD21711F1C0A077BFB689B2C1E65A7719F1F9952132BFFBE0C77707C3AE27029E91A1B09FB9CD5D2FC09BBA70E616864D34904D514151BAB45C4550605617EECC33390B7812B30CEA7ADA8975EC22842157C8500A6491B115AEA7F1AA4E0983FAE1FED77B6E8706074CB077E069C8A9079E77C08F78866DF97EFDF0B380D9C53FF8FC212BE6A1E35ACFEEB446"
"OOCC06.00.00.01WSSV"="337AD408FA42EF690B7682F617263DC4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA6A0AC4980AC7933A6A0AC4980AC79335C891EFD61E0929DBB920102EBB221DB8BC15DDCECC0F0F0C75F9C9E69E1CAB4EA1217CC8EC477C714D92936C5B5F8F3079C94CE99711189783CAD1B67039EDC29C6DC3468BF42C8542BF15600BCD744EA87BEF7E56F3F0EA0828E009944745CC5386203A1D7F82BF9AD7F8E2A380B8AA164D709DE36AD0B37EDB0A1A5C6043166992ACCA1FA77FE75AF8D5688FCAF8588B86DF8C422DE12A8DA15156B94555DA0C34DE8027AEB57AC2267E312C43DFBF22F21FE0B79AEB9534F54B3FB1647E70232F7719109584DF6986E33722DF7362416A91A5BDE471C89EE199C1C9D8A5B8B85E9C6D2C0157B23CD198509B77D7FD9DD520A135E2A55938723B1455CA647AF00780B7C9CCC81F11CEE5FE949BD2ABE1DF7D341E52D092B06C41927EA733DD60A8AA5787CFC8296870F875CACFB09F68E0EC1AA48F75B007E67BCA1452054DC319DC166A6F8273C33A90A5B0D5076178E1AE048BC077636A7044BC949ADA71224414F9643E79BFE680439977C25CD2AA0B681C6DB2D07E2DBAA37E93BF254BAB59A00135DC48E7092F7277372BBF02EE8123907A48CBF919AFE357F42197D0EDF604C13665DB21545F22C8645A74493B2EDE01B7A1FD64106B741BC699CCB38BDDF6F0732D442E5B374659D35D02FC3EBA1164EA2318466E521970621D0E7DA8D79E69079A3F6CF3794B13761711F15A596391C48658766A4193C74BB5B800936A1F787581210B4CD7AB607501C065896CB70B5792E219DD0937356F0B54949BD6028F3D03F53E816E35C74EB3256CD975325FE295696D91E98492EDC2EF89950D1C396C4200636D5A24D9B806C8AACA752038FABF8335EE2C20A30FE65C8E8BD2658E17D7876D7769A7BCA40569E9EE705FB36BD8642629B40C9C5B8D2779CF9A13B7AA866F08085C69906BF5012C09E3846F17D46161164D5DD8D543EC90A9D9C813DD4D54CD532B42106F80DEA2635CE58F66C4F8689825A5F587AC60400640408B7780BDEEDD2044E35C81632D4BA3EF22E710E695EDA392EAB3DDC72BD2DD76DAB691B83D8DE6A9FB3714573C5E09294B457C32017FA726BC10DC86377FBAB149066739A96F431D9D4974B4068FB6802DA4B8589AE8E187D07C32228D3FAA7A4910FD0091B5437851F45AA2C1E0772C6A5E03B8D936B510F9D1C57196FF289880B67C63451636B6FCE67BDD0BCA077AECB8D2314A807D98D5A352A90DBD5A0EF91573C89942AD3A654502EC98E09D1CA3B2DCC0B467C01AAC892316C9B36514EEAACEB7737D50B0052B3FCB8D1286F70157C1DE4B78AAA5D259B5510"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(920)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(976)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
c:\windows\system32\INetHTTPFilter.dll
.
Celkový čas: 2009-06-17 1:26
ComboFix-quarantined-files.txt 2009-06-17 23:26
ComboFix2.txt 2009-06-17 23:08

Před spuštěním: Volných bajtů: 24 723 197 952
Po spuštění: Volných bajtů: 24 708 177 920

216 --- E O F --- 2009-06-11 22:23

[Reklama]

[jaro3]

Vítej na fóru PC-Help!

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


1) Klikni na následující odkaz pro stažení LSPFix na Tvou pracovní plochu.
http://www.cexx.org/LSPFix.exe

nebo
http://www.cexx.org/lspfix.htm

2) Poté, co se exe soubor na ploše ukáže, poklikej na něj.
3) V levém sloupci se objeví soubor inethttpfilter.dll Kliknutím na něj se odkaz zvýrazní, potom klikni na šipku uprostřed obrazovky, který ukazuje na pravou stranu .
Tím se přesune soubor do správného sloupce označeném Odebrat (Remove)

POZNÁMKA: Pokud je šipka je šedá a neumožňuje, abys kliknul, je potřeba zaškrtnout políčko označené "Já vím, co mám dělat" (I know what..)

4) Poté, co byl soubor převeden na Odstranit( remove) sloupce, klepni na tlačítko Dokončit( Finnish) v dolní části obrazovky. Budeš informován na obrazovce že soubor byl odstraněn z Winsock záznamu v registru.Potom zavři LSPFix program .
*****************************************************************************************************************************************
Odinstaluj:
WhenU
Save
SaveNow
SearchBar
Weathercast
DAEMON Tools SearchBar


Můžeš i:
Spyware Doctor
Máš ESET Smart Security 3.0 - což je komplexní ochrana...
****************************************************************************************************************************************
Máš tam zbytky po Kaspersky a Zone Alarm..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
Folder::
c:\program files\Common Files\WhenU
c:\program files\DAEMON Tools SearchBar
c:\program files\DaemonTools_WhenUSave_Installer
c:\windows\win.tmp

File::
c:\windows\system32\zllictbl.dat
c:\windows\system32\drivers\fidbox.dat
c:\windows\system32\drivers\fidbox2.dat
c:\windows\system32\drivers\fidbox2.idx
c:\windows\system32\drivers\fidbox.idx

Driver::
fidbox
fidbox2


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe
C:\WINDOWS\system32\fmrsslink.dll
Vlož sem pak odkazy výsledků.

[thirty-six]

ahoj, tak muj problem porad trva - blokovani stranek kodem...
jo a nove aby mi nabehla web stranka tak musim vypnout firewall...
tady jsou vysledky:

fmrsslink.dll
http://www.virustotal.com/cs/analisis/e89cda2c90551acce38b5d6b3fe971a8d0534ccef178582dce23aec4fd5c891d-1245315999

plasservice.exe
http://www.virustotal.com/cs/analisis/d0c6702dfc14f337d5b48c5b9099e0daeb2b7ac03e3fd1b7e5934c96f02cce35-1243152515

ComboFix 09-06-17.02 - Vlastník 18.06.2009 10:39.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1535.1099 [GMT 2:00]
Spuštěný z: c:\documents and settings\Vlastník\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Vlastník\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\system32\drivers\fidbox.dat"
"c:\windows\system32\drivers\fidbox.idx"
"c:\windows\system32\drivers\fidbox2.dat"
"c:\windows\system32\drivers\fidbox2.idx"
"c:\windows\system32\zllictbl.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\WhenU
c:\program files\Common Files\WhenU\DTPlugin.dll
c:\windows\system32\drivers\fidbox.dat . . . . nemohl být smazán
c:\windows\system32\drivers\fidbox.idx . . . . nemohl být smazán
c:\windows\system32\drivers\fidbox2.dat . . . . nemohl být smazán
c:\windows\system32\drivers\fidbox2.idx . . . . nemohl být smazán
c:\windows\system32\zllictbl.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-18 do 2009-06-18 )))))))))))))))))))))))))))))))
.

2009-06-18 08:45 . 2009-06-18 08:46 69664 ----a-w- c:\windows\system32\drivers\fidbox.dat
2009-06-18 08:45 . 2009-06-18 08:46 2336 ----a-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-16 20:38 . 2009-06-18 08:13 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-06-16 18:50 . 2009-06-16 18:50 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-07 22:10 . 2009-06-07 22:10 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2009-06-04 18:37 . 2009-06-07 15:01 -------- d-----w- c:\windows\Internet Logs
2009-06-04 14:24 . 2009-06-04 14:24 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-06-04 14:19 . 2009-06-07 14:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-03 17:00 . 2009-06-03 17:00 -------- d-----w- c:\program files\CZshare
2009-06-03 16:15 . 2009-06-07 14:58 -------- d-----w- c:\program files\XoftSpySE
2009-06-02 16:42 . 2009-06-07 14:53 -------- d-----w- c:\program files\Anti Trojan Elite
2009-06-02 16:10 . 2009-06-02 16:10 32480 ----a-w- c:\windows\system32\Partizan.exe
2009-06-02 15:26 . 2009-06-03 17:45 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-06-02 15:26 . 2009-06-03 17:44 -------- d-----w- c:\program files\ParetoLogic

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-18 08:45 . 2009-06-18 08:45 32 ------w- c:\windows\system32\drivers\fidbox2.idx
2009-06-18 08:45 . 2009-06-18 08:45 32 ------w- c:\windows\system32\drivers\fidbox.idx
2009-06-07 14:54 . 2007-12-09 11:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-04 18:21 . 2008-03-26 10:25 823 ----a-w- c:\windows\win.tmp
2009-05-20 11:12 . 2007-12-05 16:17 -------- d-----w- c:\program files\Sony Ericsson
2009-05-20 11:12 . 2007-12-05 16:17 -------- d-----w- c:\program files\Common Files\Teleca Shared
2009-05-20 11:07 . 2007-11-14 16:06 -------- d-----w- c:\program files\Testy Autoškola
2009-05-08 08:43 . 2009-05-08 08:42 -------- d-----w- c:\program files\Alchemy Mindworks
2009-05-07 22:23 . 2008-09-04 21:37 -------- d-----w- c:\program files\SpeedFan
2009-05-07 21:41 . 2009-05-07 21:41 -------- d-----w- c:\program files\VeryPDF PDF2Word v3.0
2009-05-07 21:07 . 2009-05-07 21:07 279998 ----a-w- c:\windows\Icon Converter Plus Uninstaller.exe
2009-05-07 21:07 . 2009-05-07 21:07 -------- d-----w- c:\program files\Icon Converter Plus
2009-05-07 19:06 . 2008-08-13 20:55 -------- d-----w- c:\program files\IrfanView
2009-05-07 15:44 . 2004-08-17 13:49 345088 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:53 . 2004-08-17 13:49 660480 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:53 . 2004-08-17 13:49 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 20:11 . 2004-08-17 13:44 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-16 21:08 . 2001-10-25 12:00 74876 ----a-w- c:\windows\system32\perfc005.dat
2009-04-16 21:08 . 2001-10-25 12:00 403596 ----a-w- c:\windows\system32\perfh005.dat
2009-04-15 15:18 . 2004-08-17 13:49 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2004-10-01 13:00 . 2007-10-01 20:23 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-17_23.05.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-18 08:45 . 2009-06-18 08:45 16384 c:\windows\temp\Perflib_Perfdata_ec.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-08-08 2610608]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-21 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"ooccctrl.exe"="c:\program files\OO Software\CleverCache\ooccctrl.exe" [2007-01-28 1911568]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-12-7 113664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{51C55F9E-C308-4c95-89AB-8858D8AFD819}"= "c:\program files\ParetoLogic\Anti-Spyware\PASShlExt.dll" [2007-03-29 98304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0Partizan\0SsiEfr.e

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 15:00 15872]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 9:21 468224]
R2 ZeppelinService;plasservice;c:\program files\Common Files\ParetoLogic\PLAS\plasservice.exe [18.2.2009 14:40 587216]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [5.12.2007 18:45 13352]
S3 pctplsg;pctplsg;\??\c:\windows\system32\drivers\pctplsg.sys --> c:\windows\system32\drivers\pctplsg.sys [?]
S3 se46bus;Sony Ericsson Device 070 driver (WDM);c:\windows\system32\drivers\se46bus.sys [5.12.2007 18:35 61536]
S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter;c:\windows\system32\drivers\se46mdfl.sys [5.12.2007 18:35 9360]
S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver;c:\windows\system32\drivers\se46mdm.sys [5.12.2007 18:35 97088]
S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\se46mgmt.sys [5.12.2007 18:41 88624]
S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS);c:\windows\system32\drivers\se46nd5.sys [5.12.2007 18:41 18704]
S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface;c:\windows\system32\drivers\se46obex.sys [5.12.2007 18:40 86432]
S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM);c:\windows\system32\drivers\se46unic.sys [5.12.2007 18:41 90800]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-05-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2009-06-03 c:\windows\Tasks\ParetoLogic Anti-Spyware.job
- c:\program files\ParetoLogic\Anti-Spyware\Pareto_AS.exe [2007-04-17 14:40]

2009-06-18 c:\windows\Tasks\ParetoLogic Anti-Virus PLUS.job
- c:\program files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.exe [2009-02-18 12:43]

2009-06-09 c:\windows\Tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job
- c:\program files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.exe [2009-02-18 12:43]

2009-06-09 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 10:25]

2009-06-17 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 10:25]

2009-06-17 c:\windows\Tasks\ParetoLogic Update.job
- c:\program files\Common Files\ParetoLogic\UUS\Pareto_Update.exe [2007-04-11 11:39]

2009-06-18 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-31 20:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - c:\windows\system32\fmrsslink.dll/201
FF - ProfilePath -

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-18 10:46
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):32,29,af,f1,c9,bf,ad,21,b3,01,ff,09,3f,8c,b2,1e,74,27,ca,5f,e6,
56,05,2d,da,bf,70,54,a7,a9,e6,55,1f,04,5c,f9,41,f5,3e,60,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{6ea73178-4a5b-4344-99b9-3315bb61734b}]
@Denied: (Full) (Everyone)
"Model"=dword:00000001
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):76,8f,cb,8b,cc,98,f5,7e,ba,bd,45,f2,a9,ce,7f,5b,34,83,62,11,83,
f6,72,f7,b7,80,f5,68,7c,78,14,18,27,23,ca,61,56,67,c7,26,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{b479778b-32c3-4501-a289-542d8126d0ce}]
@Denied: (Full) (Everyone)
"Model"=dword:0000007d
"Therad"=dword:0000001e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,07,f3,08,32,3e,19,f6,d1,36,1e,bd,9f,03,55,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="80EA413A62D875761803D9B92F12D7E16E422F86570865B2B658B99088286EAD6985DA52E8CD0B21F7DE846DB554DA05E2A6A658BD3CA2360F40ED9EA05C36BCF31FD72DE5A4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA6A0AC4980AC7933A6A0AC4980AC7933A7E04BA9E8C23738390AA8B2DF4BEB5F4D2325A8FE167C24C46189F05BA8859930444F314F88BDD0335EC94C0D038E9BBC2B266FFD0F71DF15F1B4A9F43DACF7AFC186172BB1D0A75A72D91B1339119D2EBED82CFB5FE7055F6B222D7BA388AB507B28D533B627AC7DF6DC3260C68A3D34422DAABA5FF2779C03501DA658CBBF8E9AE0083552B1353FA64C45F44848B9B71E8B58902DDCFB1971B341C2175BA33D47D16C918212F898BB942D679D48B1F23ECBC6E729A03E77F432842DE3D0AA02308EE83C0C1F94D17518E75FEA3EADF7163DABBFF8F04CAACE28755A04798C57891D053D7462890999AA159B989295A8962161A906B0187D45E247510257E40A09FB6CB1889BB9346C9679ECD2DFB63D3BAEE54B7CF7F68AA126502EAB2033BB691A6E48D53DEE973D967EB709F5C2427F0FDAE0CD15A5C2B1288D1E933CD963E8DBFE46316CD6CF58DDB1F5EFD7CE96E3DF0636B007C1ECC5959A6610CA22C9CB18370430857FC99491C236003ED46D6D33512F1B824DA0B68CBD5D3A1CB48C569C52ED2F175F4947480818759331512590CA414E70AEC95A9F5AEEF1B5A31DD529AF04CCE04D644C9178514FF8269A9670A5F7486D312A91577E1A5752DFC396F0535A6CDC860784ED33AAD140D8FAD34135EF4E4A02563B2DD672D1DD4317EB1C66193534ABEED2D0F6030671D2757065F4DC6B8BB336BF90381E0CFA0807AD46B2FC9144C0AF9E25AA49B84781E285B20384EBE7BC0907E39859F27ECD54B501AAD6B121AC2FD447D50578B337EDAEF2204160CDF8DC7E8092F238F29795E1CE5F0A8890BEA9E288264E1AD727178EE4B3819E5EA4189830E44FD3164DB416A88B8F4C0EA5ABBEADEBD2B60CECB149B9C6463FEBE3F24B3073E47FD6B96DB7790972F847F59A5EEE9CD2A85C83E5069787272080BB7A8F3644BD385D8C5333A2D7D34D9E282B3EFA502590874FAFF19946CD61D8188F63E782FA4182D8CBF4779DE7CDAA1AE8DE70C433538114DDBE4C7B7969E346E548DFFC4F9FD21711F1C0A077BFB689B2C1E65A7719F1F9952132BFFBE0C77707C3AE27029E91A1B09FB9CD5D2FC09BBA70E616864D34904D514151BAB45C4550605617EECC33390B7812B30CEA7ADA8975EC22842157C8500A6491B115AEA7F1AA4E0983FAE1FED77B6E8706074CB077E069C8A9079E77C08F78866DF97EFDF0B380D9C53FF8FC212BE6A1E35ACFEEB446"
"OOCC06.00.00.01WSSV"="337AD408FA42EF690B7682F617263DC4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA6A0AC4980AC7933A6A0AC4980AC79335C891EFD61E0929DBB920102EBB221DB8BC15DDCECC0F0F0C75F9C9E69E1CAB4EA1217CC8EC477C714D92936C5B5F8F3079C94CE99711189783CAD1B67039EDC29C6DC3468BF42C8542BF15600BCD744EA87BEF7E56F3F0EA0828E009944745CC5386203A1D7F82BF9AD7F8E2A380B8AA164D709DE36AD0B37EDB0A1A5C6043166992ACCA1FA77FE75AF8D5688FCAF8588B86DF8C422DE12A8DA15156B94555DA0C34DE8027AEB57AC2267E312C43DFBF22F21FE0B79AEB9534F54B3FB1647E70232F7719109584DF6986E33722DF7362416A91A5BDE471C89EE199C1C9D8A5B8B85E9C6D2C0157B23CD198509B77D7FD9DD520A135E2A55938723B1455CA647AF00780B7C9CCC81F11CEE5FE949BD2ABE1DF7D341E52D092B06C41927EA733DD60A8AA5787CFC8296870F875CACFB09F68E0EC1AA48F75B007E67BCA1452054DC319DC166A6F8273C33A90A5B0D5076178E1AE048BC077636A7044BC949ADA71224414F9643E79BFE680439977C25CD2AA0B681C6DB2D07E2DBAA37E93BF254BAB59A00135DC48E7092F7277372BBF02EE8123907A48CBF919AFE357F42197D0EDF604C13665DB21545F22C8645A74493B2EDE01B7A1FD64106B741BC699CCB38BDDF6F0732D442E5B374659D35D02FC3EBA1164EA2318466E521970621D0E7DA8D79E69079A3F6CF3794B13761711F15A596391C48658766A4193C74BB5B800936A1F787581210B4CD7AB607501C065896CB70B5792E219DD0937356F0B54949BD6028F3D03F53E816E35C74EB3256CD975325FE295696D91E98492EDC2EF89950D1C396C4200636D5A24D9B806C8AACA752038FABF8335EE2C20A30FE65C8E8BD2658E17D7876D7769A7BCA40569E9EE705FB36BD8642629B40C9C5B8D2779CF9A13B7AA866F08085C69906BF5012C09E3846F17D46161164D5DD8D543EC90A9D9C813DD4D54CD532B42106F80DEA2635CE58F66C4F8689825A5F587AC60400640408B7780BDEEDD2044E35C81632D4BA3EF22E710E695EDA392EAB3DDC72BD2DD76DAB691B83D8DE6A9FB3714573C5E09294B457C32017FA726BC10DC86377FBAB149066739A96F431D9D4974B4068FB6802DA4B8589AE8E187D07C32228D3FAA7A4910FD0091B5437851F45AA2C1E0772C6A5E03B8D936B510F9D1C57196FF289880B67C63451636B6FCE67BDD0BCA077AECB8D2314A807D98D5A352A90DBD5A0EF91573C89942AD3A654502EC98E09D1CA3B2DCC0B467C01AAC892316C9B36514EEAACEB7737D50B0052B3FCB8D1286F70157C1DE4B78AAA5D259B5510"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(900)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3376)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\TGTSoft\StyleXP\StyleXPService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\oodag.exe
c:\program files\OO Software\CleverCache\ooccag.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\WgaTray.exe
.
**************************************************************************
.
Celkový čas: 2009-06-18 10:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-18 08:50
ComboFix2.txt 2009-06-17 23:26
ComboFix3.txt 2009-06-17 23:08

Před spuštěním: Volných bajtů: 24 800 309 248
Po spuštění: Volných bajtů: 24 784 502 784

213 --- E O F --- 2009-06-11 22:23

[jaro3]

Stáhni si program OTMoveIt3 (by OldTimer)
http://www.edisk.cz/stahni/07995/OTMove ... .39KB.html
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE

Kód: Vybrat vše

:Processes
explorer.exe

:Services

:Reg

:Files
c:\windows\system32\drivers\fidbox.dat
c:\windows\system32\drivers\fidbox.idx
c:\windows\system32\drivers\fidbox2.dat
c:\windows\system32\drivers\fidbox2.idx

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]


- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.
*****************************************************************************************************************************************
zkus odinstalovat:
ParetoLogic


Stáhni si :Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit, smazat, přesunout nebo přejmenovat
*********************************************************************************************************************************************
Stáhni si FixIEDef by ShadowPuterDude
http://downloads.malwareteks.com/FixIEDef.exe

na plochu.
Poklepej na FixIEDef
Až se objeví Copyright and Disclaimer notice, klikni na OK a poté na Scan.
Když se objeví zpráva , klikni na OK. Když program skončí , klikni na Exit.
Log se objeví na ploše. Vlož celý obsah toho logu sem.

Poté i nový log z HJT.
*****************************************************************************************************************************************
EDIT:
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
"BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00

Zvol uložit na plochu, jako název dej: fix.reg , typ: všechny soubory.
Najdi na ploše tento soubor , poklepej na něj a potvrď do registru.

[thirty-six]

tak tady jsou dalsi logy:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File move failed. c:\windows\system32\drivers\fidbox.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\drivers\fidbox.idx scheduled to be moved on reboot.
File move failed. c:\windows\system32\drivers\fidbox2.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\drivers\fidbox2.idx scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\etilqs_9wN6nJgUb7yhrP18e974 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_11c.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTM by OldTimer - Version 2.1.0.1 log created on 06182009_225812

Files moved on Reboot...
File move failed. c:\windows\system32\drivers\fidbox.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\drivers\fidbox.idx scheduled to be moved on reboot.
File move failed. c:\windows\system32\drivers\fidbox2.dat scheduled to be moved on reboot.
File move failed. c:\windows\system32\drivers\fidbox2.idx scheduled to be moved on reboot.
File C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\etilqs_9wN6nJgUb7yhrP18e974 not found!
C:\WINDOWS\temp\Perflib_Perfdata_11c.dat moved successfully.
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Vlastník\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\1ah2odcc.default\XUL.mfl moved successfully.

Registry entries deleted on Reboot...

********************************************************************************
* *
* FixIEDef Log *
* Version 1.7.22.7514 *
* *
********************************************************************************

Created at 23:15:09 on Thursday, June 18, 2009

Time Zone :

Logged On User : Vlastník

Operating System : Systém Microsoft Windows XP Professional Service Pack 2
OS Architecture : X86
System Langauge : Czech
Keyboard Layout : Czech
Processor : X64 AMD Athlon(tm) 64 Processor 3000+

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

System Drive Type : Fixed
System Drive Status : READY
System Drive Label :
System Drive Size : 131.06 GB
System Drive Free : 23.56 GB

Total Physical Memory: 1535 MB
Free Physical Memory : 983 MB
Total Page File : 1535 MB
Free Page File : 1873 MB
Total Virtual Memory : 2048 MB
Free Virtual Memory : 1965 MB

Boot State : Normal boot


********
* HJT *
********

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:24:18, on 18.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\OO Software\CleverCache\ooccag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Vlastník\Plocha\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4D91-8333-CF10577473F7} - C:\Documents and Settings\Vlastník\Google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 6719 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.+ info o chování compu.

[thirty-six]

zdar, tak tady je log. jinak zatim nic novyho - zaheslovani stranek kodem furt nezlomeno a k tomu me porad obtezujou
vyskakovaci sprostacky reklamy:) jinak pocitac bezi normalne az na ten net se zakazanym firewallem.
jo a pri nabehu windowsu se objevi nejaka hlaska partizan-bootwach rootkit - predpokladam ze je to nejakej antirootkit, jen nevim
kdy a jak jsem to tam nainstaloval..

Malwarebytes' Anti-Malware 1.38
Verze databáze: 2307
Windows 5.1.2600 Service Pack 2

19.6.2009 8:24:49
mbam-log-2009-06-19 (08-24-40).txt

Typ skenu: Rychlý sken
Objektu skenováno: 90754
Uplynulý cas: 2 minute(s), 43 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 2
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> No action taken.

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
C:\Program Files\ICQToolbar\toolbaru.dll (Adware.BHO) -> No action taken.

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log + nový log z HJT.
*****************************************************************************************************************************************
Vlož sem ještě také log z LopFind
Stáhni, vybal a spusť LopFind - Po jeho spuštění se během chvíle zobrazí textový dokument, jinak také uložený na disku pod umístěním C:\lop.txt, zkopíruj celý jeho obsah sem.

[thirty-six]

tak tady jsou:

Malwarebytes' Anti-Malware 1.38
Verze databáze: 2307
Windows 5.1.2600 Service Pack 2

20.6.2009 13:03:07
mbam-log-2009-06-20 (13-03-00).txt

Typ skenu: Úplný sken (C:\|H:\|)
Objektu skenováno: 209593
Uplynulý cas: 53 minute(s), 52 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 2

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
c:\documents and settings\Vlastník\dokumenty\ztažené-rozbalené\adobe photoshop cs3 extended\adobe photoshop cs3 extended key generator\Adobe photoshop CS3 Extended Key Generator.exe (Trojan.Horst) -> No action taken.
c:\documents and settings\Vlastník\dokumenty\ztažené-rozbalené\daemon_tools\daemon tools pro v4.10.0218\Patch\daemon.tools.pro.patch.exe (Trojan.Agent) -> No action taken.




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:13:21, on 20.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\OO Software\CleverCache\ooccag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Vlastník\Plocha\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4D91-8333-CF10577473F7} - C:\Documents and Settings\Vlastník\Google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 6594 bytes



LopFind v4 © Čas: 14:14:52,87 Datum: so 20.06.2009

******************************************

1) Výpis obsahů Application Data složek pro zjištění podezřelých adresářů:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\All Users\DATAAP~1

19.06.2009 08:16 <DIR> Malwarebytes
16.06.2009 21:04 <DIR> DAEMON Tools Pro
07.06.2009 20:31 <DIR> PC Tools
04.06.2009 16:19 <DIR> Spybot - Search & Destroy
03.06.2009 22:45 <DIR> SUPERAntiSpyware.com
03.06.2009 19:54 <DIR> Lavasoft
03.06.2009 19:44 <DIR> ParetoLogic Anti-Spyware
02.06.2009 17:26 <DIR> ParetoLogic Anti-Virus PLUS
02.06.2009 17:26 <DIR> ParetoLogic
07.05.2009 23:24 <DIR> Custom Skin Clock
10.10.2008 17:12 <DIR> Pinnacle
23.06.2008 18:44 <DIR> PEERNET
26.03.2008 12:22 <DIR> TEMP
20.02.2008 18:50 <DIR> Kaspersky Lab Setup Files
19.12.2007 00:54 <DIR> Adobe Systems
15.12.2007 22:59 <DIR> FLEXnet
15.12.2007 22:56 <DIR> ALM
08.12.2007 19:46 <DIR> Adobe
05.12.2007 18:08 <DIR> Apple Computer
04.12.2007 16:20 <DIR> ESET
08.11.2007 19:31 1747 QTSBandwidthCache
08.11.2007 19:31 <DIR> Apple
08.11.2007 19:28 <DIR> Windows Genuine Advantage
21.10.2007 15:41 <DIR> Google
21.10.2007 15:41 <DIR> Skype
02.10.2007 11:30 <DIR> CyberLink
01.10.2007 20:43 <DIR> Ahead
28.09.2007 21:12 62 desktop.ini
28.09.2007 21:12 <DIR> ..
28.09.2007 21:12 <DIR> .
28.09.2007 21:12 <DIR> Microsoft
2 soubor…, 1809 bajt…
Adres ý…: 29, Volněch bajt…: 22578999296
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\Guest\DATAAP~1

06.02.2009 11:08 <DIR> Google
06.02.2009 11:08 <DIR> ICQ Toolbar
26.01.2009 18:08 <DIR> ICQ
26.01.2009 14:36 <DIR> Macromedia
26.01.2009 14:36 <DIR> Adobe
26.01.2009 14:35 <DIR> Mozilla
26.01.2009 14:34 <DIR> Skype
24.01.2009 20:11 <DIR> Sony Ericsson
24.01.2009 20:05 <DIR> ESET
24.01.2009 20:04 <DIR> Identities
24.01.2009 20:04 62 desktop.ini
24.01.2009 20:04 <DIR> ..
24.01.2009 20:04 <DIR> .
24.01.2009 20:04 <DIR> Microsoft
1 soubor…, 62 bajt…
Adres ý…: 13, Volněch bajt…: 22578999296
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\Vlastnˇk\DATAAP~1

19.06.2009 08:16 <DIR> Malwarebytes
16.06.2009 22:38 <DIR> DAEMON Tools
16.06.2009 20:50 <DIR> DAEMON Tools Pro
03.06.2009 22:44 <DIR> SUPERAntiSpyware.com
02.06.2009 20:53 <DIR> Hyperz
08.05.2009 10:31 <DIR> Alchemy Mindworks
06.04.2009 20:42 <DIR> IDMComp
26.02.2009 20:50 <DIR> Mp3tag
14.02.2009 23:06 <DIR> COWON
14.02.2009 22:18 <DIR> Winamp
14.02.2009 21:01 <DIR> foobar2000
03.08.2008 00:29 <DIR> IDM
23.06.2008 18:44 <DIR> PEERNET
26.03.2008 12:21 <DIR> PC Tools
02.03.2008 12:29 <DIR> HEXelon
02.03.2008 11:19 <DIR> iView
19.01.2008 23:00 <DIR> Help
09.12.2007 19:35 <DIR> Media Player Classic
05.12.2007 18:21 <DIR> Teleca
05.12.2007 18:20 <DIR> Sony Ericsson
05.12.2007 16:42 <DIR> WinRAR
04.12.2007 18:29 <DIR> DMCache
04.12.2007 16:21 <DIR> ESET
13.11.2007 22:27 17144 GDIPFONTCACHEV1.DAT
10.11.2007 14:25 <DIR> ICQ Toolbar
09.11.2007 18:12 <DIR> Mozilla
09.11.2007 18:12 <DIR> ICQ
09.11.2007 18:11 <DIR> InstallShield
08.11.2007 19:31 <DIR> Apple Computer
24.10.2007 23:54 <DIR> Skype
21.10.2007 15:50 <DIR> Google
21.10.2007 15:28 <DIR> Macromedia
02.10.2007 11:30 <DIR> CyberLink
01.10.2007 22:26 <DIR> Adobe
01.10.2007 22:26 <DIR> InterTrust
01.10.2007 21:54 <DIR> Ahead
28.09.2007 19:34 <DIR> Identities
28.09.2007 19:34 62 desktop.ini
28.09.2007 19:34 <DIR> ..
28.09.2007 19:34 <DIR> .
28.09.2007 19:34 <DIR> Microsoft
2 soubor…, 17206 bajt…
Adres ý…: 39, Volněch bajt…: 22578995200
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\Default User\DATAAP~1

28.09.2007 21:12 62 desktop.ini
28.09.2007 21:12 <DIR> ..
28.09.2007 21:12 <DIR> Microsoft
28.09.2007 21:12 <DIR> .
1 soubor…, 62 bajt…
Adres ý…: 3, Volněch bajt…: 22578995200
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\LocalService\DATAAP~1

04.06.2009 20:22 <DIR> Webroot
28.09.2007 19:34 <DIR> Microsoft
28.09.2007 19:34 <DIR> ..
28.09.2007 19:34 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 4, Volněch bajt…: 22578995200
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\NetworkService\DATAAP~1

28.09.2007 19:34 <DIR> ..
28.09.2007 19:34 <DIR> Microsoft
28.09.2007 19:34 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 3, Volněch bajt…: 22578995200
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Documents and Settings\All Users\Application Data

16.06.2009 22:40 <DIR> ..
16.06.2009 22:40 <DIR> DAEMON Tools Pro
16.06.2009 22:40 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 3, Volněch bajt…: 22578995200

******************************************

2) Zjišťování přítomnosti ve složce Program Files:

a) Výpis obsahu Program Files složky pro zjištění duplicitních kopií podezřelých adresářů:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\Program Files

19.06.2009 08:16 <DIR> .
19.06.2009 08:16 <DIR> ..
23.06.2008 21:14 <DIR> Adobe
23.06.2008 21:14 <DIR> Adobe Media Player
01.10.2007 20:43 <DIR> Ahead
08.05.2009 10:43 <DIR> Alchemy Mindworks
07.06.2009 16:53 <DIR> Anti Trojan Elite
08.11.2007 19:31 <DIR> Apple Software Update
28.09.2007 19:43 <DIR> ATI Technologies
19.01.2008 23:24 <DIR> audiograbber
29.09.2007 15:26 <DIR> AvRack
15.12.2007 22:55 <DIR> Bonjour
24.02.2009 01:36 <DIR> CCleaner
18.06.2009 10:41 <DIR> Common Files
28.09.2007 19:17 <DIR> ComPlus Applications
01.10.2007 22:24 <DIR> CyberLink
01.10.2007 22:26 <DIR> CyberLink DVD Solution
03.06.2009 19:00 <DIR> CZshare
18.06.2009 10:13 <DIR> DAEMON Tools Lite
09.12.2007 13:25 <DIR> DJBCP Codec Pack
26.03.2008 12:04 <DIR> ESET
14.02.2009 21:01 <DIR> foobar2000
21.10.2007 15:41 <DIR> Google
07.05.2009 23:07 <DIR> Icon Converter Plus
17.03.2009 23:11 <DIR> ICQ6
04.12.2007 15:18 <DIR> ICQToolbar
06.04.2009 20:44 <DIR> IDM Computer Solutions
14.02.2009 23:05 <DIR> InstallShield Installation Information
04.08.2008 14:12 <DIR> Internet Download Manager
12.06.2009 00:23 <DIR> Internet Explorer
07.05.2009 21:06 <DIR> IrfanView
01.03.2009 23:18 <DIR> JetAudio
09.12.2007 18:41 <DIR> K-Lite Codec Pack
19.06.2009 08:16 <DIR> Malwarebytes' Anti-Malware
15.08.2008 16:15 <DIR> Messenger
28.09.2007 19:19 <DIR> microsoft frontpage
02.10.2007 00:01 <DIR> Microsoft Office
03.01.2009 12:52 <DIR> MKVtoolnix
26.07.2008 22:50 <DIR> MOBILedit!
29.09.2007 15:10 <DIR> Movie Maker
20.06.2009 14:07 <DIR> Mozilla Firefox
02.04.2009 21:38 <DIR> Mp3tag
28.09.2007 19:16 <DIR> MSN
28.09.2007 19:16 <DIR> MSN Gaming Zone
06.12.2007 13:47 <DIR> MSXML 4.0
24.09.2008 22:25 <DIR> Mv2Player
29.09.2007 15:10 <DIR> NetMeeting
28.09.2007 19:18 <DIR> Online Services
11.06.2008 12:09 <DIR> OO Software
13.10.2007 13:41 <DIR> Outlook Express
18.06.2009 23:04 <DIR> ParetoLogic
23.06.2008 18:44 <DIR> PC Translator 2007
23.06.2008 18:43 <DIR> PDF Creator Plus 4.0
16.04.2009 21:13 <DIR> QuickTime
29.09.2007 15:26 <DIR> Realtek Sound Manager
24.10.2007 23:54 <DIR> Skype
14.02.2009 20:23 <DIR> Slovnik cizich slov
20.05.2009 13:12 <DIR> Sony Ericsson
08.05.2009 00:23 <DIR> SpeedFan
07.06.2009 16:47 <DIR> Spybot - Search & Destroy
16.04.2009 23:12 <DIR> TC UP
03.01.2008 20:21 <DIR> Tclip
04.06.2009 16:24 <DIR> TeaTimer (Spybot - Search & Destroy)
04.12.2007 16:12 <DIR> Tencent
20.05.2009 13:07 <DIR> Testy Autoçkola
11.06.2008 12:03 <DIR> TGTSoft
28.09.2007 19:34 <DIR> Uninstall Information
07.05.2009 23:41 <DIR> VeryPDF PDF2Word v3.0
14.02.2009 22:19 <DIR> Winamp
05.12.2007 23:31 <DIR> Windows Media Connect 2
23.06.2008 18:44 <DIR> Windows Media Player
29.09.2007 15:09 <DIR> Windows NT
29.09.2007 15:11 <DIR> WindowsUpdate
02.01.2008 21:36 <DIR> WinRAR
28.09.2007 19:19 <DIR> xerox
07.06.2009 16:58 <DIR> XoftSpySE
05.12.2007 20:01 <DIR> XS++
05.12.2007 20:47 <DIR> Zero G Registry
0 soubor…, 0 bajt…
Adres ý…: 78, Volněch bajt…: 22˙578˙991˙104

b) Vyhledávání podvodných sponzorovaných programů ve složce Program Files:

Nebyly nalezeny žádné podvodné programy.

******************************************

3) Vyhledávání a odstranění podezřelých .job souborů:

a) Soubory přítomné v C:\WINDOWS\tasks\ adresáři:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\WINDOWS\Tasks

03.06.2009 19:45 418 ParetoLogic Update.job
03.06.2009 19:44 454 ParetoLogic Anti-Spyware.job
02.06.2009 17:37 448 ParetoLogic Registration.job
31.03.2009 22:56 260 WGASetup.job
08.11.2007 19:31 284 AppleSoftwareUpdate.job
28.09.2007 19:19 6 SA.DAT
28.09.2007 19:17 65 desktop.ini
28.09.2007 19:17 <DIR> .
28.09.2007 19:17 <DIR> ..
7 soubor…, 1˙935 bajt…
Adres ý…: 2, Volněch bajt…: 22˙578˙991˙104

––––––––––––––––––––––––––––––––––––––––––

b) Zjišťování vlastností přítomných .job souborů:

[TRACE] Enumerating jobs and queues
[TRACE] Activating job 'AppleSoftwareUpdate.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\Apple Software Update\SoftwareUpdate.exe'
Parameters: '-task'
WorkingDirectory: ''
Comment: ''
Creator: 'SYSTEM'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 05/30/2009 9:59:00
NextRun: 06/27/2009 9:59:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 0
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Weekly
WeeksInterval: 1
DaysOfTheWeek: ......A
StartDate: 11/08/2007
EndDate: 00/00/0000
StartTime: 09:59
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0


[TRACE] Activating job 'ParetoLogic Anti-Spyware.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe'
Parameters: '-quickscan -hidesplash'
WorkingDirectory: 'C:\Program Files\ParetoLogic\Anti-Spyware\'
Comment: 'ParetoLogic Anti-Spyware'
Creator: 'Vlastník'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 00/00/0000 0:00:00
NextRun: 06/26/2009 3:00:00
StartError: SCHED_S_TASK_HAS_NOT_RUN
ExitCode: 0
Status: SCHED_S_TASK_HAS_NOT_RUN
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Weekly
WeeksInterval: 1
DaysOfTheWeek: .....F.
StartDate: 06/03/2009
EndDate: 00/00/0000
StartTime: 03:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0


[TRACE] Activating job 'ParetoLogic Registration.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\WINDOWS\system32\rundll32.exe'
Parameters: '"C:\Program Files\Common Files\ParetoLogic\UUS2\UUS.dll" RunUns'
WorkingDirectory: 'C:\Program Files\Common Files\ParetoLogic\UUS2'
Comment: ''
Creator: 'Vlastník'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 06/09/2009 18:00:02
NextRun: 06/20/2009 18:00:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Daily
DaysInterval: 1
StartDate: 06/02/2009
EndDate: 00/00/0000
StartTime: 18:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0


[TRACE] Activating job 'ParetoLogic Update.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\Common Files\ParetoLogic\UUS\Pareto_Update.exe'
Parameters: ''
WorkingDirectory: 'C:\Program Files\Common Files\ParetoLogic\UUS'
Comment: 'ParetoLogic Update'
Creator: 'Vlastník'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 06/19/2009 0:33:00
NextRun: 06/21/2009 0:33:00
StartError: S_OK
ExitCode: 0x1
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Daily
DaysInterval: 1
StartDate: 06/03/2009
EndDate: 00/00/0000
StartTime: 00:33
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0


[TRACE] Activating job 'WGASetup.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\WINDOWS\system32\KB905474\wgasetup.exe'
Parameters: '/autoauto'
WorkingDirectory: ''
Comment: ''
Creator: 'SYSTEM'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 06/20/2009 14:07:08
NextRun: 00/00/0000 0:00:00
StartError: S_OK
ExitCode: 0x4c7
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: AtLogon
StartDate: 01/01/1972
EndDate: 00/00/0000
StartTime: 00:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0


––––––––––––––––––––––––––––––––––––––––––

c) Nalezené a odstraněné nežádoucí soubory:


––––––––––––––––––––––––––––––––––––––––––

d) Soubory přítomné v adresáři po vymazání:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 6478-7A80.

Věpis adres ýe C:\WINDOWS\Tasks

03.06.2009 19:45 418 ParetoLogic Update.job
03.06.2009 19:44 454 ParetoLogic Anti-Spyware.job
02.06.2009 17:37 448 ParetoLogic Registration.job
31.03.2009 22:56 260 WGASetup.job
08.11.2007 19:31 284 AppleSoftwareUpdate.job
28.09.2007 19:19 6 SA.DAT
28.09.2007 19:17 65 desktop.ini
28.09.2007 19:17 <DIR> .
28.09.2007 19:17 <DIR> ..
7 soubor…, 1˙935 bajt…
Adres ý…: 2, Volněch bajt…: 22˙578˙954˙240

******************************************

4) Zjišťování přítomnosti v registru:

a) Vyhledávání spouštěcích bodů v registru:

Nebyly nalezeny žádné spouštěcí body v registru.

b) Export výjimek IE pop-up blockeru:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow]
"PopupMgr"="yes"

c) Export povolení Windows firewallu:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

»»»»»»»»»»»»» Konec výpisu «««««««««««««««

[jaro3]

Kód: Vybrat vše

Infikované soubory:
c:\documents and settings\Vlastník\dokumenty\ztažené-rozbalené\adobe photoshop cs3 extended\adobe photoshop cs3 extended key generator\Adobe photoshop CS3 Extended Key Generator.exe (Trojan.Horst) -> No action taken.
c:\documents and settings\Vlastník\dokumenty\ztažené-rozbalené\daemon_tools\daemon tools pro v4.10.0218\Patch\daemon.tools.pro.patch.exe (Trojan.Agent) -> No action taken.


To samozřejmě hned smaž:
. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM..

Odinstaluj , pokud jsi dělal , následně smaž složky:
C:\Documents and Settings\All Users\DATAAP~1
ParetoLogic Anti-Spyware
ParetoLogic Anti-Virus PLUS
ParetoLogic
Kaspersky Lab Setup Files

C:\Program Files
ParetoLogic
TeaTimer (Spybot - Search & Destroy)
Spybot - Search & Destroy
Anti-Trojan Elite

Ponechal bych pouze ESET Smart Security

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Nainstaluj javu:
Java SE Runtime Environment 6u14
Vyber OS ( předpokládám Windows), dej zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u14-windows-i586-p.exe
Napiš , jak se chová comp.

[thirty-six]

no pc je mozno trochu rychlejsi:) a chvily to dokonce vypadalo ze ani kody to nehce, no pak se objevily... takze vse po starym

Malwarebytes' Anti-Malware 1.38
Verze databáze: 2307
Windows 5.1.2600 Service Pack 2

20.6.2009 17:15:54
mbam-log-2009-06-20 (17-15-54).txt

Typ skenu: Rychlý sken
Objektu skenováno: 90870
Uplynulý cas: 1 minute(s), 39 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:54:55, on 20.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\OO Software\CleverCache\ooccag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\javaws.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Documents and Settings\Vlastník\Plocha\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4D91-8333-CF10577473F7} - C:\Documents and Settings\Vlastník\Google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 6956 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O8 - Extra context menu item: ÔÚFoxmailÖĐĚíĽÓ¸ĂRSSƵµŔ/ƵµŔ×é - res://C:\WINDOWS\system32\fmrsslink.dll/201

Proveď kontrolu a vlož sem log z Kaspersky Online Scanner!

-Ve vistě musíš prohlížeč otevřít jako administrátor. K užití skeneru je třeba stáhnout a nainstalovat programové soubory a databázi.
-V Linuxu skener neskenuje RAM, boot. sektor a MBR, takže nemůže detekovat nákazy v těchto místech.
-Skener detekuje nákazy, které jsou již v PC, takže se potom dají manuálně smazat.
-Před skenem je vhodné vypnout rez. ochranu antiviru a antispywaru.
Klikni na Accept, k potvrzení podmínek.
Pokud se Ti objeví okno zabezpečení prostředí java- dej přijmout.
- Začne se stahovat databáze a program.
- Po jeho skončení klikni vlevo na pod Scan na My computer
Začne sken Tvého PC.
Sken může trvat i několik hodin.. Po ukončení skenu klikni na Scan Report.
Poté zvol Save a název zvol: KAV.
Obsah mi sem prosím zkopíruj.