Malwarebytes' Anti-Malware Vyřešeno

[parmazan]

prosim o radu jak se toho zbavit nebo co stim.
http://www.malwarebytes.org

Verze databáze: 4419

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12.8.2010 22:55:10
mbam-log-2010-08-12 (22-55-10).txt

Typ skenu: Úplný sken (C:\|H:\|)
Skenované objekty: 277502
Uplynulý čas: 31 minuta(y), 12 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 10

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\war1,2\Warcraft 3 CZ (F)\Crack\warcraft3 keygen.exe (Trojan.Agent) -> No action taken.
H:\Documents and Settings\DEIVOS\Plocha\Nepoužívané odkazy plochy\Nová složka\Call_Of_Duty_4_Crackfix_And_Keygen-Razor1911\keygen\rzr-cod4.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{33581DEA-5F32-4D6C-A648-9E8634D7C3D0}\RP133\A0043557.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{33581DEA-5F32-4D6C-A648-9E8634D7C3D0}\RP136\A0043933.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{8E691A95-DC0B-43ED-9B14-E3DFD3C5D285}\RP1\A0000383.exe (Adware.ADON) -> No action taken.
H:\System Volume Information\_restore{9E767623-8F12-4A47-A0AF-4D83333148F7}\RP3\A0003139.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{9E767623-8F12-4A47-A0AF-4D83333148F7}\RP3\A0003147.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{9E767623-8F12-4A47-A0AF-4D83333148F7}\RP3\A0003148.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{9E767623-8F12-4A47-A0AF-4D83333148F7}\RP3\A0003152.exe (Trojan.Agent.CK) -> No action taken.
H:\System Volume Information\_restore{9E767623-8F12-4A47-A0AF-4D83333148F7}\RP3\A0003153.exe (Trojan.Agent.CK) -> No action taken.

[Reklama]

[bledulka]

Ahoj,
v mbamu vše smaž.


Stahni Rsit http://images.malwareremoval.com/random/RSIT.exe
-spusť, klikni na tlačítko Continue
-po skenu na tebe vyběhne log.txt,obsah vlož zde

[parmazan]

tady je obsah:Logfile of random's system information tool 1.08 (written by random/random)
Run by DEIVOS at 2010-08-12 23:13:37
Microsoft Windows XP Home Edition Service Pack 3
System drive H: has 382 GB (80%) free of 477 GB
Total RAM: 3327 MB (86% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:13:44, on 12.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
H:\Program Files\Eset\nod32krn.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\WINDOWS\system32\PnkBstrB.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\wuauclt.exe
H:\Program Files\Common Files\Java\Java Update\jusched.exe
H:\Program Files\Eset\nod32kui.exe
H:\WINDOWS\system32\ctfmon.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Mozilla Firefox\plugin-container.exe
H:\WINDOWS\system32\wuauclt.exe
H:\Documents and Settings\DEIVOS\Dokumenty\Stažené soubory\RSIT.exe
H:\Program Files\trend micro\DEIVOS.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - H:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "H:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://H:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Program Files\ICQ6.5\ICQ.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\system32\browseui.dll
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - H:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: NMIndexingService - Unknown owner - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - H:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - H:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 5404 bytes

======Scheduled tasks folder======

H:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
H:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - H:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - H:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=H:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"NvCplDaemon"=H:\WINDOWS\system32\NvCpl.dll [2010-04-03 13670504]
"nod32kui"=H:\Program Files\Eset\nod32kui.exe [2010-06-23 949376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=H:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
H:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
H:\WINDOWS\RTHDCPL.EXE [2007-03-21 16126464]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
h:\program files\steam\steam.exe [2010-08-08 1238352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wlidsvc"=2
"SeaPort"=2
"odserv"=3
"CLTNetCnService"=2
"JavaQuickStarterService"=2
"StarWindServiceAE"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=
scecli

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1
"ShutdownWithoutLogon"=1
"NoDispCPL"=0
"NoDispSettingsPage"=0
"NoDispScrSavPage"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoResolveSearch"=1
"NoResolveTrack"=1
"NoViewContextMenu"=0
"NoFileAssociate"=0
"NoFind"=0
"NoRun"=0
"NoClose"=0
"StartMenuLogoff"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"H:\Program Files\ICQ6.5\ICQ.exe"="H:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"H:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="H:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"H:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="H:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"H:\Program Files\Mozilla Firefox\firefox.exe"="H:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"H:\WINDOWS\system32\mmc.exe"="H:\WINDOWS\system32\mmc.exe:*:Enabled:Konzola Microsoft Management Console"
"H:\WINDOWS\system32\ftp.exe"="H:\WINDOWS\system32\ftp.exe:*:Enabled:Program pro přenos souborů"
"H:\WINDOWS\system32\PnkBstrA.exe"="H:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"H:\WINDOWS\system32\PnkBstrB.exe"="H:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"H:\Program Files\Java\jre6\bin\java.exe"="H:\Program Files\Java\jre6\bin\java.exe:*:Disabled:Java(TM) Platform SE binary"
"H:\Program Files\Skype\Plugin Manager\skypePM.exe"="H:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"H:\Program Files\Steam\steam.exe"="H:\Program Files\Steam\steam.exe:*:Disabled:Steam 732897"
"H:\WINDOWS\system32\rundll32.exe"="H:\WINDOWS\system32\rundll32.exe:*:Disabled:Run a DLL as an App"
"H:\WINDOWS\system32\dpvsetup.exe"="H:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"H:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4sp.exe"="H:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4sp.exe:*:Enabled:Call of Duty: Modern Warfare 2"
"H:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4mp.exe"="H:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4mp.exe:*:Enabled:Call of Duty: Modern Warfare 2 - Multiplayer"
"H:\Program Files\Skype\Phone\Skype.exe"="H:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-08-12 23:08:29 ----DC---- H:\rsit
2010-08-11 20:54:02 ----D---- H:\WINDOWS\system32\CatRoot2
2010-08-11 15:13:19 ----DC---- H:\Documents and Settings\DEIVOS\Data aplikací\Malwarebytes
2010-08-11 15:13:13 ----A---- H:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-08-11 15:13:12 ----DC---- H:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2010-08-11 15:13:11 ----D---- H:\Program Files\Malwarebytes' Anti-Malware
2010-08-11 15:13:11 ----A---- H:\WINDOWS\system32\drivers\mbam.sys
2010-08-10 22:38:46 ----D---- H:\Program Files\Trend Micro
2010-08-09 11:55:01 ----DC---- H:\Documents and Settings\DEIVOS\Data aplikací\Nero
2010-08-09 11:53:14 ----D---- H:\Program Files\Nero
2010-08-09 11:53:06 ----DC---- H:\Documents and Settings\All Users.WINDOWS\Data aplikací\Nero
2010-08-09 11:53:04 ----D---- H:\Program Files\Common Files\Nero
2010-08-08 16:21:12 ----D---- H:\Program Files\Steam
2010-08-08 15:49:49 ----D---- H:\Program Files\Microsoft Windows 7 Upgrade Advisor
2010-07-25 12:48:35 ----D---- H:\Program Files\Wise Disk Cleaner
2010-07-24 14:51:38 ----D---- H:\Program Files\Common Files\DESIGNER
2010-07-24 11:41:46 ----D---- H:\Program Files\4DiskcleanG
2010-07-24 10:52:59 ----D---- H:\Program Files\A1Click Ultra PC Cleaner
2010-07-18 13:06:52 ----DC---- H:\Documents and Settings\DEIVOS\Data aplikací\Black Sea Studios
2010-07-18 13:06:51 ----A---- H:\WINDOWS\system32\CmdLineExt03.dll

======List of files/folders modified in the last 1 months======

2010-08-12 23:11:54 ----AD---- H:\WINDOWS
2010-08-12 23:11:47 ----D---- H:\WINDOWS\temp
2010-08-12 23:10:34 ----D---- H:\WINDOWS\system32\drivers
2010-08-12 21:57:33 ----DC---- H:\Documents and Settings\DEIVOS\Data aplikací\Skype
2010-08-12 21:47:58 ----A---- H:\WINDOWS\system32\PnkBstrB.exe
2010-08-12 20:56:31 ----DC---- H:\Documents and Settings\DEIVOS\Data aplikací\skypePM
2010-08-12 19:14:26 ----D---- H:\WINDOWS\Microsoft.NET
2010-08-12 18:05:45 ----SHDC---- H:\Config.Msi
2010-08-12 18:05:42 ----SHD---- H:\WINDOWS\Installer
2010-08-12 18:05:40 ----D---- H:\WINDOWS\system32
2010-08-12 18:05:40 ----AC---- H:\WINDOWS\system32\PerfStringBackup.INI
2010-08-12 18:05:32 ----RSD---- H:\WINDOWS\assembly
2010-08-12 18:05:31 ----D---- H:\WINDOWS\WinSxS
2010-08-12 10:50:19 ----HD---- H:\WINDOWS\inf
2010-08-11 20:54:22 ----D---- H:\WINDOWS\system32\CatRoot
2010-08-11 15:13:11 ----RD---- H:\Program Files
2010-08-11 14:56:05 ----D---- H:\Program Files\Crawler
2010-08-10 23:06:45 ----RSHDC---- H:\WINDOWS\system32\dllcache
2010-08-10 23:06:45 ----D---- H:\Program Files\Internet Explorer
2010-08-10 23:06:23 ----HD---- H:\WINDOWS\$hf_mig$
2010-08-10 23:00:20 ----D---- H:\WINDOWS\Prefetch
2010-08-10 22:59:59 ----D---- H:\WINDOWS\Debug
2010-08-10 22:38:47 ----SDC---- H:\Documents and Settings\DEIVOS\Data aplikací\Microsoft
2010-08-10 19:53:04 ----D---- H:\Program Files\Movie Maker
2010-08-10 19:51:43 ----DC---- H:\Documents and Settings\All Users.WINDOWS\Data aplikací\Microsoft Help
2010-08-10 16:00:13 ----D---- H:\WINDOWS\system32\XPSViewer
2010-08-10 16:00:12 ----RSD---- H:\WINDOWS\Fonts
2010-08-09 16:52:32 ----D---- H:\Program Files\Wise Registry Cleaner
2010-08-09 11:53:04 ----D---- H:\Program Files\Common Files
2010-08-08 16:38:39 ----D---- H:\WINDOWS\system32\DirectX
2010-08-08 16:25:55 ----D---- H:\WINDOWS\system32\config
2010-08-08 16:25:39 ----D---- H:\WINDOWS\system32\wbem
2010-08-08 16:25:38 ----D---- H:\WINDOWS\Registration
2010-08-08 13:47:40 ----D---- H:\WINDOWS\system32\mui
2010-08-06 22:00:37 ----D---- H:\Program Files\WinRAR
2010-08-06 22:00:37 ----D---- H:\Program Files\Mozilla Firefox
2010-08-03 20:09:31 ----AC---- H:\WINDOWS\system32\MRT.exe
2010-07-29 10:29:01 ----D---- H:\Program Files\CCleaner
2010-07-27 08:30:31 ----A---- H:\WINDOWS\system32\shell32.dll
2010-07-24 14:38:44 ----AC---- H:\WINDOWS\DCheck95.ini
2010-07-24 13:52:18 ----DC---- H:\Documents and Settings\All Users.WINDOWS\Data aplikací\CanonIJPLM
2010-07-24 12:45:44 ----SD---- H:\WINDOWS\Tasks
2010-07-24 12:36:38 ----DC---- H:\Documents and Settings\All Users.WINDOWS\Data aplikací\TuneUp Software
2010-07-18 15:09:14 ----AC---- H:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; H:\WINDOWS\System32\Drivers\sptd.sys [2009-12-28 721904]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; H:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 intelppm;Řadič procesoru Intel; H:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; H:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 nod32drv;nod32drv; H:\WINDOWS\system32\drivers\nod32drv.sys [2010-06-23 15424]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; H:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R2 AMON;AMON; H:\WINDOWS\system32\drivers\amon.sys [2010-06-23 512096]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; H:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; H:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; H:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; H:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); H:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-03-26 4395008]
R3 mouhid;Ovladač myši standardu HID; H:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; H:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; H:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-04-03 10232128]
R3 pcouffin;VSO Software pcouffin; H:\WINDOWS\System32\Drivers\pcouffin.sys [2009-12-22 47360]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; H:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; H:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; H:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 CCDECODE;Dekodér Closed Caption; H:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; H:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; H:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; H:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; H:\WINDOWS\system32\drivers\ccdcmb.sys [2008-05-02 17536]
S3 PAC207;Eye 110; H:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-10-25 616064]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; H:\WINDOWS\System32\Drivers\RootMdm.sys [2006-03-02 5888]
S3 SLIP;BDA Slip De-Framer; H:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; H:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbprint;Třída USB Printer; H:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; H:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 Wdf01000;Wdf01000; H:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; H:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; H:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; H:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 IJPLMSVC;Inkjet Printer/Scanner Extended Survey Program; H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2008-01-22 103808]
R2 NOD32krn;NOD32 Kernel Service; H:\Program Files\Eset\nod32krn.exe [2010-06-23 552064]
R2 NVSvc;NVIDIA Display Driver Service; H:\WINDOWS\system32\nvsvc32.exe [2010-04-03 154216]
R2 PnkBstrA;PnkBstrA; H:\WINDOWS\system32\PnkBstrA.exe [2010-01-29 75064]
R2 PnkBstrB;PnkBstrB; H:\WINDOWS\system32\PnkBstrB.exe [2010-08-12 219128]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; H:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 gupdate;Služba Google Update (gupdate); H:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-01 136176]
S3 aspnet_state;Stavová služba ASP.NET; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DfSdkS;Defragmentation-Service; H:\Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\Dfsdks.exe [2009-08-24 406016]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; h:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 ose;Office Source Engine; H:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WinRM;Windows Remote Management (WS-Management); H:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; H:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 CLTNetCnService;Symantec Lic NetConnect service; H:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S4 JavaQuickStarterService;Java Quick Starter; H:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 odserv;Microsoft Office Diagnostics Service; H:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S4 SeaPort;SeaPort; H:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]

-----------------EOF-----------------

[bledulka]

Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano

- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna

- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.

[parmazan]

tady je log z combofixu:ComboFix 10-08-12.03 - DEIVOS 13.08.2010 11:53:10.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3327.2967 [GMT 2:00]
Spuštěný z: h:\documents and settings\DEIVOS\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\windows\system32\Temp

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-13 do 2010-08-13 )))))))))))))))))))))))))))))))
.

2010-08-12 21:08 . 2010-08-12 21:08 -------- dc----w- H:\rsit
2010-08-11 18:54 . 2010-08-13 09:53 -------- d-----w- h:\windows\system32\CatRoot2
2010-08-11 13:13 . 2010-04-29 13:39 38224 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys
2010-08-11 13:13 . 2010-08-11 13:13 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware
2010-08-11 13:13 . 2010-04-29 13:39 20952 ----a-w- h:\windows\system32\drivers\mbam.sys
2010-08-10 20:38 . 2010-08-12 21:13 -------- d-----w- h:\program files\Trend Micro
2010-08-10 17:55 . 2010-08-10 17:55 -------- dcsh--w- h:\documents and settings\NetworkService.NT AUTHORITY.003\IETldCache
2010-08-09 09:53 . 2010-08-09 10:00 -------- d-----w- h:\program files\Nero
2010-08-09 09:53 . 2010-08-09 10:01 -------- d-----w- h:\program files\Common Files\Nero
2010-08-08 14:25 . 2010-08-08 14:25 -------- d-----w- h:\windows\system32\wbem\Repository
2010-08-08 14:21 . 2010-08-11 19:17 -------- d-----w- h:\program files\Steam
2010-08-08 13:49 . 2010-08-08 14:21 -------- d-----w- h:\program files\Microsoft Windows 7 Upgrade Advisor
2010-08-02 11:21 . 2010-08-02 11:21 -------- dc-h--w- h:\documents and settings\DEIVOS\Recent(2)
2010-07-25 10:48 . 2010-08-12 21:37 -------- d-----w- h:\program files\Wise Disk Cleaner
2010-07-24 09:41 . 2010-07-24 09:44 -------- d-----w- h:\program files\4DiskcleanG
2010-07-24 08:52 . 2010-07-24 09:39 -------- d-----w- h:\program files\A1Click Ultra PC Cleaner
2010-07-18 11:06 . 2010-07-18 11:19 43520 ----a-w- h:\windows\system32\CmdLineExt03.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-12 21:49 . 2006-03-02 12:00 488776 ----a-w- h:\windows\system32\perfh005.dat
2010-08-12 21:49 . 2006-03-02 12:00 107506 ----a-w- h:\windows\system32\perfc005.dat
2010-08-12 19:47 . 2009-12-10 17:04 219128 ----a-w- h:\windows\system32\PnkBstrB.exe
2010-08-12 19:07 . 2009-12-10 17:05 138592 -c--a-w- h:\windows\system32\drivers\PnkBstrK.sys
2010-08-11 12:56 . 2009-10-18 09:04 -------- d-----w- h:\program files\Crawler
2010-08-09 14:52 . 2010-07-10 09:42 -------- d-----w- h:\program files\Wise Registry Cleaner
2010-08-01 08:28 . 2010-06-20 15:03 664 ----a-w- h:\windows\system32\d3d9caps.dat
2010-07-29 08:29 . 2009-03-16 19:52 -------- d-----w- h:\program files\CCleaner
2010-07-10 10:15 . 2010-07-10 09:58 -------- d-----w- h:\program files\Glary Registry Repair
2010-06-30 12:33 . 2006-03-02 12:00 149504 ----a-w- h:\windows\system32\schannel.dll
2010-06-24 12:27 . 2006-03-02 12:00 916480 ----a-w- h:\windows\system32\wininet.dll
2010-06-24 09:02 . 2006-03-02 12:00 1851904 ----a-w- h:\windows\system32\win32k.sys
2010-06-23 15:20 . 2010-06-23 14:47 -------- d-----w- h:\program files\ESET
2010-06-23 14:47 . 2010-06-23 14:48 512096 -c--a-w- h:\windows\system32\drivers\amon.sys
2010-06-23 14:47 . 2010-06-23 14:48 298104 ----a-w- h:\windows\system32\imon.dll
2010-06-23 14:47 . 2010-06-23 14:48 15424 -c--a-w- h:\windows\system32\drivers\nod32drv.sys
2010-06-21 15:27 . 2006-03-02 12:00 354304 ----a-w- h:\windows\system32\drivers\srv.sys
2010-06-20 16:07 . 2010-06-20 16:07 -------- d-----w- h:\program files\Common Files\Skype
2010-06-17 14:03 . 2006-03-02 12:00 80384 ----a-w- h:\windows\system32\iccvid.dll
2010-06-17 13:06 . 2009-03-30 17:18 -------- d-----w- h:\program files\ICQ6.5
2010-06-14 14:31 . 2009-03-16 18:33 744448 -c--a-w- h:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2006-03-02 12:00 1172480 ----a-w- h:\windows\system32\msxml3.dll
2010-06-12 10:31 . 2010-06-12 10:31 -------- d-----w- h:\windows\Fonts\AdvUninstal
2006-06-15 18:33 . 2009-04-10 11:14 233472 -c--a-w- h:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 16:43 . 2009-04-10 11:14 204895 -c--a-w- h:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 12:41 . 2009-04-10 11:14 77824 -c--a-w- h:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 11:10 . 2009-04-10 11:14 426081 -c--a-w- h:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 10:19 . 2009-04-10 11:14 458752 -c--a-w- h:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 16:35 . 2009-04-10 11:14 139264 -c--a-w- h:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 09:10 . 2009-04-10 11:14 204800 -c--a-w- h:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 09:42 . 2009-04-10 11:14 106496 -c--a-w- h:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 09:22 . 2009-04-10 11:14 212992 -c--a-w- h:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 09:21 . 2009-04-10 11:14 167936 -c--a-w- h:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="h:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"nod32kui"="h:\program files\Eset\nod32kui.exe" [2010-06-23 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 -c--a-w- h:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 -c--a-w- h:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-03-21 06:49 16126464 -c----r- h:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-08-08 14:28 1238352 ----a-w- h:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wlidsvc"=2 (0x2)
"SeaPort"=2 (0x2)
"odserv"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"StarWindServiceAE"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=h:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="h:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"h:\\Program Files\\ICQ6.5\\ICQ.exe"=
"h:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"h:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\WINDOWS\\system32\\mmc.exe"=
"h:\\WINDOWS\\system32\\ftp.exe"=
"h:\\WINDOWS\\system32\\PnkBstrA.exe"=
"h:\\WINDOWS\\system32\\PnkBstrB.exe"=
"h:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"h:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"h:\\Program Files\\Steam\\steam.exe"=
"h:\\WINDOWS\\system32\\dpvsetup.exe"=
"h:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"h:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

R1 nod32drv;nod32drv;h:\windows\system32\drivers\nod32drv.sys [23.6.2010 16:48 15424]
S2 gupdate;Služba Google Update (gupdate);h:\program files\Google\Update\GoogleUpdate.exe [1.4.2010 19:25 136176]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;h:\windows\system32\drivers\atl01_xp.sys [16.3.2009 21:02 38656]
S3 DfSdkS;Defragmentation-Service;h:\program files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\DfSdkS.exe [12.6.2010 15:32 406016]
S3 PAC207;Eye 110;h:\windows\system32\drivers\PFC027.SYS [10.4.2009 13:09 616064]
S3 WinRM;Windows Remote Management (WS-Management);h:\windows\system32\svchost.exe -k WINRM [2.3.2006 14:00 14336]
S4 sptd;sptd;h:\windows\system32\drivers\sptd.sys [16.3.2009 23:07 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'

2010-08-13 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- h:\program files\Google\Update\GoogleUpdate.exe [2010-04-01 17:24]

2010-08-12 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- h:\program files\Google\Update\GoogleUpdate.exe [2010-04-01 17:24]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mWindow Title = Microsoft Internet Explorer
IE: E&xportovat do aplikace Microsoft Excel - h:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: h:\windows\system32\imon.dll
FF - ProfilePath - h:\documents and settings\DEIVOS\Data aplikací\Mozilla\Firefox\Profiles\tk5a70hi.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: h:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: h:\program files\Common Files\ParallelGraphics\Cortona\npCortona.dll
FF - plugin: h:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: h:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: h:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - h:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autoFill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
h:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
h:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-13 11:57
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2320)
h:\windows\system32\msi.dll
h:\windows\system32\webcheck.dll
h:\windows\system32\WPDShServiceObj.dll
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
h:\windows\system32\nvsvc32.exe
h:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
h:\program files\Canon\IJPLM\IJPLMSVC.EXE
h:\program files\Eset\nod32krn.exe
h:\windows\system32\PnkBstrA.exe
h:\windows\system32\PnkBstrB.exe
h:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-08-13 11:58:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-13 09:58

Před spuštěním: Volných bajtů: 400 183 046 144
Po spuštění: Volných bajtů: 400 159 670 272

- - End Of File - - E0EB772A8B79B1DA769B97DDEE082BD2

[parmazan]

tak jsem to ješte jednou projel MBAMEM a vylezlo toto: Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4424

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13.8.2010 17:16:08
mbam-log-2010-08-13 (17-16-08).txt

Typ skenu: Úplný sken (C:\|H:\|)
Skenované objekty: 278633
Uplynulý čas: 31 minuta(y), 23 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\System Volume Information\_restore{33581DEA-5F32-4D6C-A648-9E8634D7C3D0}\RP204\A0061846.exe (Trojan.Agent) -> No action taken.
H:\System Volume Information\_restore{33581DEA-5F32-4D6C-A648-9E8634D7C3D0}\RP204\A0061847.exe (Trojan.Agent.CK) -> No action taken.

[parmazan]

problem!!!
Soubory, které systém Microsoft Update potřebuje, již nejsou v počítači zaregistrovány nebo nainstalovány. Tak je chci nainstalovat a
Na webu došlo k potížím a požadovanou stránku nelze zobrazit. a [Číslo chyby: 0x8007041D]Stažení a instalace nejnovějšího softwaru pro aktualizace
Co stim.

[jaro3]

Vsuvka

Co jsem četl , tak aktrualizace windows mají nějaký problém , napřed to byl .Net Framework , teď možná i ostatní. Každopádně se to týká pouze win XP SP3.
Zaručenou odpověď nemám , takže zkus vyčkat..