Problém s virem Vyřešeno

[Satanek66]

Takže log i ted snad bez problému

ComboFix 09-06-29.04 - Lukyna 30.06.2009 11:57.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.382.80 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lukyna\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090629-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-05-28 do 2009-06-30 )))))))))))))))))))))))))))))))
.

2009-06-30 09:37 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-30 09:37 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-30 09:13 . 2009-06-30 09:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-30 09:13 . 2009-06-30 09:13 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-30 09:04 . 2009-06-30 09:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-06-30 08:25 . 2009-06-30 08:25 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2009-06-30 08:25 . 2009-06-30 09:03 -------- d-----w- c:\documents and settings\Administrator\Šablony
2009-06-30 08:25 . 2009-06-30 09:03 -------- d-----w- c:\documents and settings\Administrator\Data aplikací
2009-06-30 08:25 . 2009-06-30 09:03 -------- d-s---w- c:\documents and settings\Administrator
2009-06-30 08:11 . 2009-06-30 09:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-30 05:48 . 2009-06-30 05:48 -------- d-----w- c:\documents and settings\NetworkService\IETldCache
2009-06-25 19:02 . 2009-06-25 19:02 -------- d-----w- c:\windows\Sun
2009-06-23 10:48 . 2009-06-23 10:48 -------- d-----w- c:\windows\tiinst
2009-06-23 10:26 . 2001-10-24 10:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-06-23 10:26 . 2004-08-17 13:49 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-06-23 10:18 . 2009-06-23 10:18 -------- d-----w- c:\program files\Common Files\Canon
2009-06-23 10:13 . 2004-08-03 20:58 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2009-06-23 10:13 . 2004-08-03 20:58 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-06-23 10:13 . 2004-08-03 21:10 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2009-06-23 10:13 . 2004-08-03 21:10 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-06-23 10:13 . 2004-08-03 21:10 15360 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2009-06-23 10:13 . 2004-08-03 21:10 15360 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-06-23 10:13 . 2004-08-03 21:10 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys
2009-06-23 10:13 . 2004-08-03 21:10 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-06-23 10:12 . 2004-08-03 21:10 19328 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-06-23 10:12 . 2004-08-03 21:10 19328 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-06-23 10:12 . 2004-08-03 21:10 85376 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-06-23 10:12 . 2004-08-03 21:10 85376 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-06-23 10:12 . 2004-08-03 21:10 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-06-23 10:12 . 2004-08-03 21:10 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-06-23 10:12 . 2004-08-17 13:49 54272 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-06-23 10:12 . 2004-08-17 13:49 54272 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-06-23 10:11 . 2006-11-03 08:59 48128 ----a-w- c:\windows\system32\Remove.exe
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\windows\PixArt
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\program files\Common Files\PAC207
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\program files\PC Camer@
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\windows\Downloaded Installations
2009-06-23 09:56 . 2006-10-26 17:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-06-23 09:53 . 2009-06-23 09:53 -------- d-----w- c:\program files\Microsoft Works
2009-06-23 09:53 . 2009-06-23 09:53 -------- d-----w- c:\program files\MSBuild
2009-06-23 09:50 . 2009-06-23 09:50 -------- d-----w- c:\program files\Microsoft.NET
2009-06-23 09:46 . 2009-06-23 09:46 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-06-23 09:45 . 2009-06-23 09:52 -------- d-----w- c:\windows\SHELLNEW
2009-06-23 09:44 . 2009-06-23 09:44 -------- d--h--r- C:\MSOCache
2009-06-23 06:47 . 2009-06-23 06:47 -------- d-----w- c:\documents and settings\Luki\Plocha
2009-06-23 06:47 . 2009-06-23 06:47 -------- d-----w- c:\documents and settings\Luki
2009-06-23 06:44 . 2004-08-03 21:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-06-23 06:44 . 2004-08-03 21:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-06-23 06:44 . 2004-08-03 20:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-23 06:44 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-23 06:44 . 2004-08-03 21:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-06-23 06:44 . 2004-08-03 21:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-06-23 06:43 . 2009-06-23 06:43 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-06-23 06:42 . 2009-06-23 06:42 -------- d-----w- c:\program files\ScanSoft
2009-06-23 06:41 . 2009-06-23 06:41 -------- d-----w- c:\program files\ArcSoft
2009-06-23 06:41 . 1995-07-31 11:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2009-06-23 06:40 . 1998-11-13 10:58 307200 ----a-w- c:\windows\IsUn0405.exe
2009-06-23 06:39 . 2006-09-12 20:00 197632 ----a-w- c:\windows\system32\CNMLM83.DLL
2009-06-23 06:39 . 2009-06-23 06:39 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-06-23 06:38 . 2006-07-20 06:51 57344 ----a-w- c:\windows\system32\CNCI160.DLL
2009-06-23 06:38 . 2006-06-29 05:29 106496 ----a-w- c:\windows\system32\cnco160.dll
2009-06-23 06:38 . 2006-05-26 01:54 135168 ----a-w- c:\windows\system32\CNCL160.DLL
2009-06-23 06:38 . 2006-07-20 06:51 1298432 ----a-w- c:\windows\system32\CNCC160.DLL
2009-06-23 06:38 . 2009-06-23 06:38 -------- d--h--w- c:\program files\CanonBJ
2009-06-23 06:37 . 2009-06-23 10:21 -------- d-----w- c:\program files\Canon
2009-06-22 20:32 . 2009-06-22 20:32 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2009-06-22 20:32 . 2009-06-22 20:32 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-22 20:29 . 2009-06-22 20:29 -------- d-----w- c:\program files\NetLimiter 2 Lite
2009-06-21 08:33 . 2009-06-21 08:34 -------- d-----w- c:\program files\GameSpy Arcade
2009-06-20 06:21 . 2009-06-20 06:21 -------- d-----w- c:\program files\MSXML 4.0
2009-06-19 17:48 . 2009-06-19 17:48 -------- d-sh--w- c:\documents and settings\Lukyna\IECompatCache
2009-06-19 17:48 . 2009-06-19 17:48 -------- d-sh--w- c:\documents and settings\Lukyna\PrivacIE
2009-06-19 06:56 . 2009-06-19 06:56 -------- d-----w- c:\program files\AnswerWorks 4.0
2009-06-19 06:51 . 2009-06-19 06:58 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-06-19 06:51 . 2009-06-19 06:51 -------- d-----w- c:\program files\Autodesk
2009-06-18 23:42 . 2009-06-18 23:42 -------- d-----w- c:\program files\IObit
2009-06-18 23:17 . 2009-06-18 23:17 -------- d-----w- c:\program files\CCleaner
2009-06-18 23:06 . 2009-06-18 23:06 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-18 22:58 . 2009-02-25 13:15 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-06-18 22:54 . 2009-06-18 22:54 -------- d-----w- C:\ATI
2009-06-18 22:47 . 2009-06-18 22:47 -------- d-sh--w- c:\documents and settings\Lukyna\IETldCache
2009-06-18 22:37 . 2009-06-18 22:37 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-18 22:11 . 2009-06-18 22:11 -------- d-----w- c:\program files\Common Files\Skype
2009-06-18 22:10 . 2009-06-18 22:11 -------- d-----r- c:\program files\Skype
2009-06-18 21:27 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-18 21:26 . 2009-04-30 21:16 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-18 21:26 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-18 21:26 . 2009-04-30 21:16 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-18 21:25 . 2009-06-18 21:31 -------- d-----w- c:\windows\ie8updates
2009-06-18 21:23 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-18 21:03 . 2009-06-18 21:21 -------- dc-h--w- c:\windows\ie8
2009-06-18 21:03 . 2009-06-18 21:17 -------- d-----w- c:\windows\system32\cs-CZ
2009-06-18 20:27 . 2009-06-18 20:27 -------- d-----w- c:\program files\VideoLAN
2009-06-18 20:13 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2009-06-18 20:13 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2009-06-18 20:13 . 2009-06-18 20:17 -------- d-----w- c:\program files\PDFCreator

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-23 12:18 . 2004-08-18 12:00 73614 ----a-w- c:\windows\system32\perfc005.dat
2009-06-23 12:18 . 2004-08-18 12:00 398984 ----a-w- c:\windows\system32\perfh005.dat
2009-06-23 10:48 . 2009-06-18 18:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-23 06:43 . 2009-06-18 18:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-21 10:51 . 2009-06-18 18:12 -------- d-----w- c:\program files\Launch Manager
2009-06-19 20:05 . 2009-06-18 17:41 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-19 20:05 . 2009-06-18 17:41 2378 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-06-19 20:04 . 2009-06-18 17:41 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-06-18 23:10 . 2009-06-18 23:09 -------- d-----w- c:\program files\Winamp
2009-06-18 23:03 . 2009-06-18 18:11 -------- d-----w- c:\program files\ATI Technologies
2009-06-18 20:02 . 2009-06-18 19:54 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-18 18:51 . 2009-06-18 18:47 -------- d-----w- c:\program files\Ahead
2009-06-18 18:50 . 2009-06-18 18:50 -------- d-----w- c:\program files\IrfanView
2009-06-18 18:50 . 2009-06-18 18:50 -------- d-----w- c:\program files\Common Files\Nero
2009-06-18 18:48 . 2009-06-18 18:48 0 ----a-w- c:\windows\nsreg.dat
2009-06-18 18:48 . 2009-06-18 18:48 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-18 18:30 . 2009-06-18 18:27 -------- d-----w- c:\program files\QIP
2009-06-18 18:22 . 2009-06-18 18:22 -------- d-----w- c:\program files\Alwil Software
2009-06-18 18:14 . 2009-06-18 18:14 -------- d-----w- c:\program files\Synaptics
2009-06-18 18:13 . 2009-06-18 18:13 -------- d-----w- c:\program files\CONEXANT
2009-06-18 18:10 . 2009-06-18 18:10 -------- d-----w- c:\program files\AMD
2009-06-18 18:02 . 2009-06-18 18:02 -------- d-----w- c:\program files\InterVideo
2009-06-18 17:59 . 2009-06-18 17:59 139330 ----a-w- c:\windows\system32\odyGina.dll
2009-06-18 17:59 . 2009-06-18 17:59 532558 ----a-w- c:\windows\system32\odGinaLibrary.dll
2009-06-18 17:59 . 2009-06-18 17:59 106496 ----a-w- c:\windows\system32\odyEvent.dll
2009-06-18 17:46 . 2009-06-18 17:46 -------- d-----w- c:\program files\microsoft frontpage
2009-06-18 17:45 . 2009-06-18 17:45 -------- d-----w- c:\program files\Java
2009-06-18 17:45 . 2009-06-18 17:45 -------- d-----w- c:\program files\Common Files\Java
2009-06-18 17:38 . 2009-06-18 17:38 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-13 05:05 . 2004-08-18 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:44 . 2004-08-18 12:00 345088 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:32 . 2009-04-29 04:32 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-19 20:11 . 2004-08-18 12:00 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:18 . 2004-08-18 12:00 584192 ----a-w- c:\windows\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-04-18 81920]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-18 159232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Akceler tor spuçtŘnˇ AutoCADu.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-3-5 10872]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Lukyna^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\documents and settings\Lukyna\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TapiSrv"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Lukyna\\Plocha\\dcčko\\StrongDC.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18.6.2009 20:23 114768]
R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [23.4.2007 14:05 81688]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23.6.2009 11:01 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23.6.2009 11:01 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.6.2009 20:23 20560]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [18.6.2009 20:13 200192]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23.6.2009 11:01 7408]
S1 mailKmd;mailKmd; [x]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [1.3.2007 9:23 507264]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
FF - ProfilePath - c:\documents and settings\Lukyna\Data aplikací\Mozilla\Firefox\Profiles\ukhvxkx5.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPOJI610.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-30 12:00
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = c:\program files\Launch Manager\CtrlVol.exe?????T??????|x??|????q??|?j?wQj?w????????,??? ???|???????????\??????|????????h?????@????????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s???????w??@?N'?s?E9?-6@?(E9????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(636)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3932)
c:\windows\system32\webcheck.dll
.
Celkový čas: 2009-06-30 12:02
ComboFix-quarantined-files.txt 2009-06-30 10:02

Před spuštěním: Volných bajtů: 12 169 256 960
Po spuštění: Volných bajtů: 12 158 128 128

258 --- E O F --- 2009-06-22 05:52

[Reklama]

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\ativpsrm.bin
c:\windows\system32\ezsidmv.dat
c:\windows\system32\Remove.exe

DirLook::
c:\windows\tiinst

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TapiSrv"=-
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe"

Driver::
mailKmd;mailKmd
mailKmd




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[Satanek66]

ComboFix 09-06-29.04 - Lukyna 30.06.2009 12:25.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.382.126 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lukyna\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Lukyna\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090629-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\ativpsrm.bin"
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\Remove.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ativpsrm.bin
c:\windows\system32\ezsidmv.dat
c:\windows\system32\Remove.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_mailKmd


((((((((((((((((((((((((( Soubory vytvořené od 2009-05-28 do 2009-06-30 )))))))))))))))))))))))))))))))
.

2009-06-30 09:37 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-30 09:37 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-30 09:13 . 2009-06-30 09:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-30 09:13 . 2009-06-30 09:13 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-30 09:04 . 2009-06-30 09:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-06-30 08:25 . 2009-06-30 08:25 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2009-06-30 08:25 . 2009-06-30 09:03 -------- d-----w- c:\documents and settings\Administrator\Šablony
2009-06-30 08:25 . 2009-06-30 09:03 -------- d-----w- c:\documents and settings\Administrator\Data aplikací
2009-06-30 08:25 . 2009-06-30 09:03 -------- d-s---w- c:\documents and settings\Administrator
2009-06-30 08:11 . 2009-06-30 09:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-30 05:48 . 2009-06-30 05:48 -------- d-----w- c:\documents and settings\NetworkService\IETldCache
2009-06-25 19:02 . 2009-06-25 19:02 -------- d-----w- c:\windows\Sun
2009-06-23 10:48 . 2009-06-23 10:48 -------- d-----w- c:\windows\tiinst
2009-06-23 10:26 . 2001-10-24 10:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-06-23 10:26 . 2004-08-17 13:49 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-06-23 10:18 . 2009-06-23 10:18 -------- d-----w- c:\program files\Common Files\Canon
2009-06-23 10:13 . 2004-08-03 20:58 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2009-06-23 10:13 . 2004-08-03 20:58 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-06-23 10:13 . 2004-08-03 21:10 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2009-06-23 10:13 . 2004-08-03 21:10 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-06-23 10:13 . 2004-08-03 21:10 15360 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2009-06-23 10:13 . 2004-08-03 21:10 15360 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-06-23 10:13 . 2004-08-03 21:10 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys
2009-06-23 10:13 . 2004-08-03 21:10 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-06-23 10:12 . 2004-08-03 21:10 19328 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-06-23 10:12 . 2004-08-03 21:10 19328 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-06-23 10:12 . 2004-08-03 21:10 85376 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-06-23 10:12 . 2004-08-03 21:10 85376 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-06-23 10:12 . 2004-08-03 21:10 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-06-23 10:12 . 2004-08-03 21:10 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-06-23 10:12 . 2004-08-17 13:49 54272 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-06-23 10:12 . 2004-08-17 13:49 54272 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\windows\PixArt
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\program files\Common Files\PAC207
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\program files\PC Camer@
2009-06-23 10:11 . 2009-06-23 10:11 -------- d-----w- c:\windows\Downloaded Installations
2009-06-23 09:56 . 2006-10-26 17:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-06-23 09:53 . 2009-06-23 09:53 -------- d-----w- c:\program files\Microsoft Works
2009-06-23 09:53 . 2009-06-23 09:53 -------- d-----w- c:\program files\MSBuild
2009-06-23 09:50 . 2009-06-23 09:50 -------- d-----w- c:\program files\Microsoft.NET
2009-06-23 09:46 . 2009-06-23 09:46 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-06-23 09:45 . 2009-06-23 09:52 -------- d-----w- c:\windows\SHELLNEW
2009-06-23 09:44 . 2009-06-23 09:44 -------- d--h--r- C:\MSOCache
2009-06-23 06:47 . 2009-06-23 06:47 -------- d-----w- c:\documents and settings\Luki\Plocha
2009-06-23 06:47 . 2009-06-23 06:47 -------- d-----w- c:\documents and settings\Luki
2009-06-23 06:44 . 2004-08-03 21:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-06-23 06:44 . 2004-08-03 21:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-06-23 06:44 . 2004-08-03 20:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-23 06:44 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-23 06:44 . 2004-08-03 21:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-06-23 06:44 . 2004-08-03 21:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-06-23 06:43 . 2009-06-23 06:43 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2009-06-23 06:42 . 2009-06-23 06:42 -------- d-----w- c:\program files\ScanSoft
2009-06-23 06:41 . 2009-06-23 06:41 -------- d-----w- c:\program files\ArcSoft
2009-06-23 06:41 . 1995-07-31 11:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2009-06-23 06:40 . 1998-11-13 10:58 307200 ----a-w- c:\windows\IsUn0405.exe
2009-06-23 06:39 . 2006-09-12 20:00 197632 ----a-w- c:\windows\system32\CNMLM83.DLL
2009-06-23 06:39 . 2009-06-23 06:39 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2009-06-23 06:38 . 2006-07-20 06:51 57344 ----a-w- c:\windows\system32\CNCI160.DLL
2009-06-23 06:38 . 2006-06-29 05:29 106496 ----a-w- c:\windows\system32\cnco160.dll
2009-06-23 06:38 . 2006-05-26 01:54 135168 ----a-w- c:\windows\system32\CNCL160.DLL
2009-06-23 06:38 . 2006-07-20 06:51 1298432 ----a-w- c:\windows\system32\CNCC160.DLL
2009-06-23 06:38 . 2009-06-23 06:38 -------- d--h--w- c:\program files\CanonBJ
2009-06-23 06:37 . 2009-06-23 10:21 -------- d-----w- c:\program files\Canon
2009-06-22 20:32 . 2009-06-22 20:32 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2009-06-22 20:32 . 2009-06-22 20:32 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-22 20:29 . 2009-06-22 20:29 -------- d-----w- c:\program files\NetLimiter 2 Lite
2009-06-21 08:33 . 2009-06-21 08:34 -------- d-----w- c:\program files\GameSpy Arcade
2009-06-20 06:21 . 2009-06-20 06:21 -------- d-----w- c:\program files\MSXML 4.0
2009-06-19 17:48 . 2009-06-19 17:48 -------- d-sh--w- c:\documents and settings\Lukyna\IECompatCache
2009-06-19 17:48 . 2009-06-19 17:48 -------- d-sh--w- c:\documents and settings\Lukyna\PrivacIE
2009-06-19 06:56 . 2009-06-19 06:56 -------- d-----w- c:\program files\AnswerWorks 4.0
2009-06-19 06:51 . 2009-06-19 06:58 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-06-19 06:51 . 2009-06-19 06:51 -------- d-----w- c:\program files\Autodesk
2009-06-18 23:42 . 2009-06-18 23:42 -------- d-----w- c:\program files\IObit
2009-06-18 23:17 . 2009-06-18 23:17 -------- d-----w- c:\program files\CCleaner
2009-06-18 22:58 . 2009-02-25 13:15 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-06-18 22:54 . 2009-06-18 22:54 -------- d-----w- C:\ATI
2009-06-18 22:47 . 2009-06-18 22:47 -------- d-sh--w- c:\documents and settings\Lukyna\IETldCache
2009-06-18 22:11 . 2009-06-18 22:11 -------- d-----w- c:\program files\Common Files\Skype
2009-06-18 22:10 . 2009-06-18 22:11 -------- d-----r- c:\program files\Skype
2009-06-18 21:27 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-18 21:26 . 2009-04-30 21:16 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-18 21:26 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-18 21:26 . 2009-04-30 21:16 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-18 21:25 . 2009-06-18 21:31 -------- d-----w- c:\windows\ie8updates
2009-06-18 21:23 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-18 21:03 . 2009-06-18 21:21 -------- dc-h--w- c:\windows\ie8
2009-06-18 21:03 . 2009-06-18 21:17 -------- d-----w- c:\windows\system32\cs-CZ
2009-06-18 20:27 . 2009-06-18 20:27 -------- d-----w- c:\program files\VideoLAN
2009-06-18 20:13 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2009-06-18 20:13 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2009-06-18 20:13 . 2009-06-18 20:17 -------- d-----w- c:\program files\PDFCreator

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-23 12:18 . 2004-08-18 12:00 73614 ----a-w- c:\windows\system32\perfc005.dat
2009-06-23 12:18 . 2004-08-18 12:00 398984 ----a-w- c:\windows\system32\perfh005.dat
2009-06-23 10:48 . 2009-06-18 18:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-23 06:43 . 2009-06-18 18:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-21 10:51 . 2009-06-18 18:12 -------- d-----w- c:\program files\Launch Manager
2009-06-19 20:05 . 2009-06-18 17:41 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-19 20:05 . 2009-06-18 17:41 2378 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-06-19 20:04 . 2009-06-18 17:41 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-06-18 23:10 . 2009-06-18 23:09 -------- d-----w- c:\program files\Winamp
2009-06-18 23:03 . 2009-06-18 18:11 -------- d-----w- c:\program files\ATI Technologies
2009-06-18 20:02 . 2009-06-18 19:54 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-18 18:51 . 2009-06-18 18:47 -------- d-----w- c:\program files\Ahead
2009-06-18 18:50 . 2009-06-18 18:50 -------- d-----w- c:\program files\IrfanView
2009-06-18 18:50 . 2009-06-18 18:50 -------- d-----w- c:\program files\Common Files\Nero
2009-06-18 18:48 . 2009-06-18 18:48 0 ----a-w- c:\windows\nsreg.dat
2009-06-18 18:48 . 2009-06-18 18:48 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-18 18:30 . 2009-06-18 18:27 -------- d-----w- c:\program files\QIP
2009-06-18 18:22 . 2009-06-18 18:22 -------- d-----w- c:\program files\Alwil Software
2009-06-18 18:14 . 2009-06-18 18:14 -------- d-----w- c:\program files\Synaptics
2009-06-18 18:13 . 2009-06-18 18:13 -------- d-----w- c:\program files\CONEXANT
2009-06-18 18:10 . 2009-06-18 18:10 -------- d-----w- c:\program files\AMD
2009-06-18 18:02 . 2009-06-18 18:02 -------- d-----w- c:\program files\InterVideo
2009-06-18 17:59 . 2009-06-18 17:59 139330 ----a-w- c:\windows\system32\odyGina.dll
2009-06-18 17:59 . 2009-06-18 17:59 532558 ----a-w- c:\windows\system32\odGinaLibrary.dll
2009-06-18 17:59 . 2009-06-18 17:59 106496 ----a-w- c:\windows\system32\odyEvent.dll
2009-06-18 17:46 . 2009-06-18 17:46 -------- d-----w- c:\program files\microsoft frontpage
2009-06-18 17:45 . 2009-06-18 17:45 -------- d-----w- c:\program files\Java
2009-06-18 17:45 . 2009-06-18 17:45 -------- d-----w- c:\program files\Common Files\Java
2009-06-18 17:38 . 2009-06-18 17:38 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-13 05:05 . 2004-08-18 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:44 . 2004-08-18 12:00 345088 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:32 . 2009-04-29 04:32 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-19 20:11 . 2004-08-18 12:00 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:18 . 2004-08-18 12:00 584192 ----a-w- c:\windows\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\tiinst ----

2005-09-29 03:41 . 2005-09-29 03:41 8724 ----a-w- c:\windows\tiinst\tifm21.cat
2005-09-20 08:31 . 2005-09-20 08:31 6905 ----a-w- c:\windows\tiinst\tifm21.inf
2005-09-20 08:30 . 2005-09-20 08:30 162432 ----a-w- c:\windows\tiinst\tifm21.sys
2005-06-22 08:08 . 2005-06-22 08:08 140288 ----a-w- c:\windows\tiinst\uminst.exe
2005-06-21 01:00 . 2005-06-21 01:00 8852 ----a-w- c:\windows\tiinst\gtipci21.cat
2005-06-07 07:59 . 2005-06-07 07:59 3149 ----a-w- c:\windows\tiinst\gtipci21.inf
2005-05-31 09:46 . 2005-05-31 09:46 87936 ----a-r- c:\windows\tiinst\gtipci21.sys
2004-10-14 12:00 . 2004-10-14 12:00 9734 ----a-w- c:\windows\tiinst\TIFMICON.CAT
2004-10-05 15:27 . 2004-10-05 15:27 6146 ----a-w- c:\windows\tiinst\TIFMICON.INF
2004-04-14 09:12 . 2004-04-14 09:12 17016 ----a-w- c:\windows\tiinst\tiscfw.deb
2004-03-23 10:45 . 2004-03-23 10:45 28672 ----a-r- c:\windows\tiinst\cttib1.dll
2004-01-13 16:46 . 2004-01-13 16:46 172032 ----a-w- c:\windows\tiinst\tifmicon.dll


((((((((((((((((((((((((((((( SnapShot@2009-06-30_10.00.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-30 09:06 . 2009-06-30 10:31 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
- 2009-06-30 09:06 . 2009-06-30 09:31 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-06-30 10:14 . 2009-06-30 10:14 16384 c:\windows\temp\Perflib_Perfdata_660.dat
+ 2009-06-30 10:31 . 2009-06-30 10:31 16384 c:\windows\temp\Perflib_Perfdata_654.dat
+ 2009-06-30 09:06 . 2009-06-30 10:31 32768 c:\windows\temp\History\History.IE5\MSHist012009063020090701\index.dat
- 2009-06-30 09:06 . 2009-06-30 09:31 32768 c:\windows\temp\History\History.IE5\MSHist012009063020090701\index.dat
+ 2009-06-30 09:06 . 2009-06-30 10:31 32768 c:\windows\temp\History\History.IE5\index.dat
- 2009-06-30 09:06 . 2009-06-30 09:31 32768 c:\windows\temp\History\History.IE5\index.dat
+ 2009-06-30 09:06 . 2009-06-30 10:31 16384 c:\windows\temp\Cookies\index.dat
- 2009-06-30 09:06 . 2009-06-30 09:31 16384 c:\windows\temp\Cookies\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-04-18 81920]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2005-03-16 204800]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-10-11 245760]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-03-30 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-05-02 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Akceler tor spuçtŘnˇ AutoCADu.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-3-5 10872]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Lukyna^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\documents and settings\Lukyna\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Lukyna\\Plocha\\dcčko\\StrongDC.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18.6.2009 20:23 114768]
R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [23.4.2007 14:05 81688]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23.6.2009 11:01 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23.6.2009 11:01 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.6.2009 20:23 20560]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [18.6.2009 20:13 200192]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [1.3.2007 9:23 507264]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23.6.2009 11:01 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
FF - ProfilePath - c:\documents and settings\Lukyna\Data aplikací\Mozilla\Firefox\Profiles\ukhvxkx5.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPOJI610.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-30 12:32
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = c:\program files\Launch Manager\CtrlVol.exe?????T??????|x??|????q??|?j?wQj?w????????,??? ???|???????????\??????|????????h?????@????????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s???????w??@?N'?s?E9?-6@?(E9????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3592)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\NetLimiter 2 Lite\nlsvc.exe
c:\program files\NetLimiter 2 Lite\NLClient.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Celkový čas: 2009-06-30 12:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-30 10:36
ComboFix2.txt 2009-06-30 10:02

Před spuštěním: Volných bajtů: 12 151 083 008
Po spuštění: Volných bajtů: 12 134 334 464

317 --- E O F --- 2009-06-22 05:52

[Satanek66]

a ještě HT

Logfile of HijackThis v1.99.1
Scan saved at 12:37:35, on 30.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NetLimiter 2 Lite\nlsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NetLimiter 2 Lite\NLClient.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lukyna\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Lite\nlsvc.exe

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
***************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CtrlVol"="c:\\program files\\Launch Manager\\CtrlVol.exe"


Ulož si ho jako na Plochu jako fix.reg a jako typ všechny soubory , najdi tento soubor na Ploše a poklepáním ho spusť. Budeš dotázán na přidání hodnoty do registru. Schval.
*****************************************************************************************************************************************
Spusť HJT, vypni prohlížeče, odpoj se od internetu a fixni (zatrhnout políčko před hodnotou zmáčknout
"Fix checked"):

O11 - Options group: [INTERNATIONAL] International


Potom si stáhni z mého podpisu novější HJT (verzi 2.0.2 ), udělej nový log a vlož mi ho sem.

[Satanek66]

tak z verze 2

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:23:14, on 30.6.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NetLimiter 2 Lite\nlsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NetLimiter 2 Lite\NLClient.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [CtrlVol] c:\program files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Lite\nlsvc.exe

--
End of file - 5921 bytes

[Damned]

Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž
a zapni si AVG.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Označ topic za vyřešený (zelená fajfka) a měj se.

[Satanek66]

dík y za spolupráci :-)

[Damned]

Není zač a kdyby něco, tak se zastav.