prosim o pomoc!!!

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Odpovědět
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

prosim o pomoc!!!

Příspěvekod skerena » 27 zář 2008 00:48

najednou mi prestaly psat nektere znaky na klavesnici. Mam nainstalovane CZ fonty, CZ nastaveni klavesnice i systemu. Je divne, ze mi nepisi klavesy jako "ě, š, č, . . ý, á, í, é". Pritom klavesy "ř a ž" mi pisi! Nevim si s tim rady. Preinstaloval jsem SP3, preinstaloval jsem i antivir (ted off).
Posilam log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:17:00, on 27.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

--
End of file - 6731 bytes

Pridavam log z Combofix.

ComboFix 08-09-26.01 - Tony 2008-09-27 1:05:02.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.626 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Tony\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
* Resident AV is active


VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Tony\Local Settings\Data aplikacˇ\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-08-26 do 2008-09-26 )))))))))))))))))))))))))))))))
.

2008-09-26 23:50 . 2008-09-26 23:50 <DIR> d-------- C:\Program Files\ESET
2008-09-26 23:29 . 2008-04-14 08:49 102,912 -----c--- C:\WINDOWS\system32\dllcache\dpcdll.dll
2008-09-26 23:29 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\000002_.tmp
2008-09-26 23:15 . 2008-09-26 23:15 180,584 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-09-26 03:00 . 2008-09-26 23:06 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-09-25 21:17 . 2008-09-26 23:11 <DIR> d-------- C:\Program Files\Katalog film…
2008-09-25 21:17 . 2008-09-25 21:17 <DIR> d-------- C:\Program Files\Common Files\Borland Shared
2008-09-25 21:17 . 1999-01-20 05:01 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL
2008-09-25 21:17 . 1999-11-12 05:11 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL
2008-09-25 21:17 . 2008-09-26 21:18 13,030 --a------ C:\PDOXUSRS.NET
2008-09-25 19:57 . 2008-09-25 19:57 <DIR> d-------- C:\Program Files\Nero
2008-09-25 19:42 . 2008-09-25 19:44 <DIR> d-------- C:\Program Files\Your Uninstaller 2008
2008-09-25 19:42 . <DIR> C:\Documents and Settings\Tony\Data aplikací\URSoft
2008-09-25 03:48 . 2008-04-14 08:51 10,752 --------- C:\WINDOWS\system32\smtpapi.dll
2008-09-25 03:48 . 2008-04-14 08:51 9,728 --------- C:\WINDOWS\system32\rwnh.dll
2008-09-25 03:47 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\000001_.tmp
2008-09-25 03:40 . 2008-04-14 00:15 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-24 21:38 . 2008-06-24 13:45 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-09-24 21:38 . 2008-06-23 17:36 773,120 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-09-24 21:15 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Ashampoo
2008-09-24 20:24 . 2008-09-24 20:25 <DIR> d-------- C:\Program Files\FreeCommander
2008-09-24 19:44 . 2008-09-24 19:44 <DIR> d-------- C:\Program Files\CounterPath
2008-09-24 19:44 . 2008-09-24 19:44 <DIR> d-------- C:\Program Files\Common Files\Intel
2008-09-24 19:41 . 2008-04-14 08:52 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-09-24 19:41 . 2008-04-14 08:52 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
2008-09-24 19:41 . 2008-04-14 00:16 15,232 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-09-24 19:41 . 2008-04-14 00:16 15,232 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2008-09-24 19:41 . 2008-04-14 00:16 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-09-24 19:41 . 2008-04-14 00:16 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2008-09-24 19:41 . 2008-04-14 00:09 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-09-24 19:41 . 2008-04-14 00:09 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2008-09-24 19:39 . <DIR> C:\Documents and Settings\Tony\Data aplikací\FotoWire
2008-09-24 19:38 . 2008-09-24 19:38 <DIR> d-------- C:\Program Files\Common Files\FotoWire
2008-09-24 19:38 . 2004-10-08 12:46 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2008-09-24 19:37 . 2008-09-24 19:38 <DIR> d-------- C:\Program Files\Logitech
2008-09-24 19:37 . 2008-09-24 19:37 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-09-24 19:21 . 2004-11-25 07:07 79,679 --a------ C:\WINDOWS\system32\E_FLMACE.DLL
2008-09-24 19:21 . 2003-05-21 05:27 64,000 --a------ C:\WINDOWS\system32\E_FBCBACE.DLL
2008-09-24 19:21 . 2004-09-10 23:12 49,152 --a------ C:\WINDOWS\system32\E_DCINST.DLL
2008-09-24 19:21 . 2000-06-07 04:01 34,304 --a------ C:\WINDOWS\system32\E_FBCHACE.DLL
2008-09-24 19:21 . 2008-04-14 00:15 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-24 19:21 . 2008-04-14 00:15 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-24 19:21 . 2008-04-14 00:17 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-24 19:21 . 2008-04-14 00:17 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-24 19:21 . 2008-04-14 00:15 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-24 19:21 . 2008-04-14 00:15 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-24 19:20 . 2008-09-24 19:23 <DIR> d-------- C:\Program Files\epson
2008-09-24 19:20 . 2008-09-24 19:21 138,073 --a------ C:\WINDOWS\EPSTPLOG.BAK
2008-09-24 19:20 . 2005-02-25 00:00 46,080 --a------ C:\WINDOWS\system32\escimgd.dll
2008-09-24 19:20 . 2005-02-25 00:00 29,696 --a------ C:\WINDOWS\system32\escwiad.dll
2008-09-24 19:20 . 2005-02-25 00:00 22,016 --a------ C:\WINDOWS\system32\esccmd.dll
2008-09-24 18:58 . 2008-09-27 01:00 <DIR> d-------- C:\!KillBox
2008-09-24 18:54 . 2008-09-24 18:54 26 --a------ C:\WINDOWS\Lic.xxx
2008-09-24 18:53 . 2008-04-14 08:52 147,968 --a------ C:\WINDOWS\R.COM
2008-09-24 18:53 . 2008-04-14 08:52 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-09-24 18:51 . 2008-09-24 18:51 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-24 18:32 . 2008-09-24 18:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-09-24 18:31 . 2008-09-24 18:40 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-24 15:26 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Media Player Classic
2008-09-24 15:26 . 2008-09-24 15:26 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-23 21:34 . 2008-09-23 21:34 36 --a------ C:\WINDOWS\usdthank.ini
2008-09-23 21:34 . 2008-09-23 21:34 31 --a------ C:\WINDOWS\idc.ini
2008-09-23 21:10 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Mozilla
2008-09-23 16:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Chromeflower
2008-09-23 16:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\CrystalSpace
2008-09-23 16:07 . 2008-09-23 16:07 <DIR> d-------- C:\Program Files\TeddyBears
2008-09-22 22:30 . 2008-09-22 22:30 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-22 20:13 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Nero
2008-09-22 19:15 . 2008-06-23 18:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-22 19:15 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-22 19:15 . 2007-03-08 07:09 1,024,000 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-22 19:15 . 2008-06-23 18:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-22 19:15 . 2008-06-23 18:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-22 19:15 . 2008-06-23 18:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-22 19:15 . 2008-06-23 18:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-22 19:15 . 2008-06-23 18:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-22 19:15 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-22 13:25 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\skypePM
2008-09-22 13:24 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Skype
2008-09-22 13:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Macromedia
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Identities
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\ESET
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\ATI
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Adobe
2008-09-22 13:02 . 2008-09-21 21:36 <DIR> d--h----- C:\Documents and Settings\Pavla\ćablony
2008-09-22 13:02 . 2008-09-26 21:22 <DIR> d-------- C:\Documents and Settings\Pavla\Plocha
2008-09-22 13:02 . 2008-09-21 23:31 <DIR> d--h----- C:\Documents and Settings\Pavla\Okolnˇ tisk rny
2008-09-22 13:02 . 2008-09-24 09:52 <DIR> d--h----- C:\Documents and Settings\Pavla\Okolnˇ sˇś
2008-09-22 13:02 . 2008-09-26 19:06 <DIR> dr------- C:\Documents and Settings\Pavla\Oblˇben‚ polo§ky
2008-09-22 13:02 . 2008-09-21 23:31 <DIR> dr------- C:\Documents and Settings\Pavla\Nabˇdka Start
2008-09-22 13:02 . 2008-09-22 13:03 <DIR> dr------- C:\Documents and Settings\Pavla\Dokumenty
2008-09-22 13:02 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Microsoft
2008-09-22 13:02 . 2008-09-23 21:10 <DIR> dr-h----- C:\Documents and Settings\Pavla\Data aplikacˇ
2008-09-22 13:02 . 2008-09-26 23:12 <DIR> d-------- C:\Documents and Settings\Pavla
2008-09-22 10:53 . <DIR> C:\Documents and Settings\Tony\Data aplikací\ICQ
2008-09-22 10:52 . 2008-09-24 15:12 <DIR> d-------- C:\Program Files\ICQ6
2008-09-22 10:45 . 2008-09-22 10:45 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-22 10:43 . 2008-09-22 10:43 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-22 10:43 . 2008-04-14 08:52 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-22 10:42 . 2008-09-22 10:42 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-22 10:42 . 2008-09-22 10:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-22 10:40 . 2008-09-22 10:41 <DIR> d-------- C:\Program Files\The KMPlayer1431
2008-09-22 09:56 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Nero
2008-09-22 09:52 . 2008-09-25 19:58 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-09-22 09:29 . 2008-09-26 08:03 24 ---hs---- C:\WINDOWS\SA6E5241C.tmp
2008-09-22 09:24 . 2008-09-22 09:24 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-09-22 09:16 . 2008-09-26 23:11 <DIR> d-------- C:\Program Files\SMS posˇlaź Treca
2008-09-22 00:02 . <DIR> C:\Documents and Settings\Tony\Data aplikací\WinRAR
2008-09-21 22:59 . 2008-09-21 22:59 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-09-21 22:56 . 2008-09-21 22:57 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-09-21 22:56 . 2008-09-21 22:56 <DIR> dr-h----- C:\MSOCache
2008-09-21 22:53 . 2008-09-21 22:54 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-09-21 22:53 . 2008-09-21 22:53 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-09-21 22:53 . 2008-09-21 22:53 <DIR> d-------- C:\Program Files\MSBuild
2008-09-21 22:53 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-09-21 22:38 . 2008-09-21 22:38 <DIR> d-------- C:\Program Files\VIA
2008-09-21 22:38 . 2008-06-14 19:35 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-21 22:37 . 2008-09-22 22:36 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-21 22:37 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-21 22:37 . 2008-05-01 16:37 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-21 22:37 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-21 22:33 . 2008-09-21 22:33 <DIR> d-------- C:\Program Files\Marvell
2008-09-21 22:29 . 2008-09-21 22:29 <DIR> d-------- C:\Program Files\ASUS
2008-09-21 22:26 . 2008-09-21 22:26 <DIR> d-------- C:\Program Files\7-Zip
2008-09-21 22:25 . 2008-09-21 22:25 <DIR> d-------- C:\Program Files\Realtek Sound Manager

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 21:11 --------- d-----w C:\Program Files\SMS posílač Treca
2008-09-26 21:11 --------- d-----w C:\Program Files\Katalog filmů
2008-09-26 19:34 --------- d-s---w C:\Documents and Settings\Tony\Data aplikací\Microsoft
2008-09-25 16:51 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\skypePM
2008-09-25 16:51 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Skype
2008-09-24 17:37 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-09-24 16:54 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Adobe
2008-09-23 14:10 --------- d--h--r C:\Documents and Settings\Pavla\Data aplikací\Chromeflower
2008-09-21 21:44 --------- d-----w C:\Program Files\Yahoo!
2008-09-21 21:41 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\ATI
2008-09-21 21:24 --------- d-----w C:\Program Files\Skype
2008-09-21 21:24 --------- d-----w C:\Program Files\Common Files\Skype
2008-09-21 21:08 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\ESET
2008-09-21 21:05 --------- d-----w C:\Program Files\Java
2008-09-21 21:05 --------- d-----w C:\Program Files\Common Files\Java
2008-09-21 21:04 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Macromedia
2008-09-21 21:01 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Mozilla
2008-09-21 21:00 --------- d-----w C:\Program Files\Microsoft Works
2008-09-21 19:47 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Identities
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:39 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-21 04:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-08-21 02:19 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-08-21 02:18 314,880 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-08-21 02:08 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-08-21 02:08 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-08-21 02:07 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-08-21 02:07 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-08-21 02:07 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-08-21 02:05 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-08-21 02:04 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-08-21 02:01 10,084,352 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-08-21 01:55 4,094,560 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-08-21 01:50 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-08-21 01:38 2,377,856 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-08-21 01:23 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-08-21 01:19 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-08-21 01:18 37,376 ----a-w C:\WINDOWS\system32\atiadlxx.dll
2008-08-21 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-08-21 01:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-08-21 01:17 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-08-21 01:11 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-08-05 21:14 90,112 ----a-w C:\WINDOWS\system32\ATIBRTMON.EXE
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-09-24 20480]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"EPSON Stylus DX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 217088]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Tony\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-19 4742184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\ESET\\ESET Smart Security\\egui.exe"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\USD\\USDownloader.exe"=
"C:\\USD\\update.bat"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\CounterPath\\X-Lite\\x-lite.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 77312]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2008-04-14 69120]

*Newly Created Service* - PROCEXP90
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe


.
------- Doplňkový sken -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.seznam.cz/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local;localhost
O8 -: E&xportovat do aplikace Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 01:07:45
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2008-09-27 1:08:36
ComboFix-quarantined-files.txt 2008-09-26 23:08:13

Před spuštěním: Volněch bajt…: 16˙131˙207˙168
Po spuštění: Volněch bajt…: 17,941,004,288

273 --- E O F --- 2008-09-26 21:45:49
Nahoru
Reklama
Top
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43295
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: prosim o pomoc!!!

Příspěvekod jaro3 » 27 zář 2008 08:31

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
C:\WINDOWS\000002_.tmp
C:\WINDOWS\000001_.tmp

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený přejmenovaný program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

Re: prosim o pomoc!!!

Příspěvekod skerena » 27 zář 2008 09:33

ComboFix 08-09-26.01 - Tony 2008-09-27 9:20:33.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.600 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Tony\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\Tony\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení
* Resident AV is active


VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
C:\WINDOWS\000001_.tmp
C:\WINDOWS\000002_.tmp
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\000001_.tmp
C:\WINDOWS\000002_.tmp

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-08-27 do 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-09-27 09:08 . 2008-09-27 09:08 <DIR> d-------- C:\Program Files\WinASO
2008-09-27 09:00 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Uniblue
2008-09-27 01:24 . 2008-09-27 01:24 1,684 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-26 23:50 . 2008-09-26 23:50 <DIR> d-------- C:\Program Files\ESET
2008-09-26 23:29 . 2008-04-14 08:49 102,912 -----c--- C:\WINDOWS\system32\dllcache\dpcdll.dll
2008-09-26 23:15 . 2008-09-27 08:43 8,224 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-09-26 03:00 . 2008-09-26 23:06 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-09-25 21:17 . 2008-09-26 23:11 <DIR> d-------- C:\Program Files\Katalog film…
2008-09-25 21:17 . 2008-09-25 21:17 <DIR> d-------- C:\Program Files\Common Files\Borland Shared
2008-09-25 21:17 . 1999-01-20 05:01 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL
2008-09-25 21:17 . 1999-11-12 05:11 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL
2008-09-25 21:17 . 2008-09-26 21:18 13,030 --a------ C:\PDOXUSRS.NET
2008-09-25 19:57 . 2008-09-25 19:57 <DIR> d-------- C:\Program Files\Nero
2008-09-25 19:42 . 2008-09-25 19:44 <DIR> d-------- C:\Program Files\Your Uninstaller 2008
2008-09-25 19:42 . <DIR> C:\Documents and Settings\Tony\Data aplikací\URSoft
2008-09-25 03:48 . 2008-04-14 08:51 10,752 --------- C:\WINDOWS\system32\smtpapi.dll
2008-09-25 03:48 . 2008-04-14 08:51 9,728 --------- C:\WINDOWS\system32\rwnh.dll
2008-09-25 03:40 . 2008-04-14 00:15 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-24 21:38 . 2008-06-24 13:45 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-09-24 21:38 . 2008-06-23 17:36 773,120 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-09-24 21:15 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Ashampoo
2008-09-24 20:24 . 2008-09-24 20:25 <DIR> d-------- C:\Program Files\FreeCommander
2008-09-24 19:44 . 2008-09-24 19:44 <DIR> d-------- C:\Program Files\CounterPath
2008-09-24 19:44 . 2008-09-24 19:44 <DIR> d-------- C:\Program Files\Common Files\Intel
2008-09-24 19:41 . 2008-04-14 08:52 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-09-24 19:41 . 2008-04-14 08:52 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
2008-09-24 19:41 . 2008-04-14 00:16 15,232 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-09-24 19:41 . 2008-04-14 00:16 15,232 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2008-09-24 19:41 . 2008-04-14 00:16 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-09-24 19:41 . 2008-04-14 00:16 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2008-09-24 19:41 . 2008-04-14 00:09 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-09-24 19:41 . 2008-04-14 00:09 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2008-09-24 19:39 . <DIR> C:\Documents and Settings\Tony\Data aplikací\FotoWire
2008-09-24 19:38 . 2008-09-24 19:38 <DIR> d-------- C:\Program Files\Common Files\FotoWire
2008-09-24 19:38 . 2004-10-08 12:46 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2008-09-24 19:37 . 2008-09-24 19:38 <DIR> d-------- C:\Program Files\Logitech
2008-09-24 19:37 . 2008-09-24 19:37 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-09-24 19:21 . 2004-11-25 07:07 79,679 --a------ C:\WINDOWS\system32\E_FLMACE.DLL
2008-09-24 19:21 . 2003-05-21 05:27 64,000 --a------ C:\WINDOWS\system32\E_FBCBACE.DLL
2008-09-24 19:21 . 2004-09-10 23:12 49,152 --a------ C:\WINDOWS\system32\E_DCINST.DLL
2008-09-24 19:21 . 2000-06-07 04:01 34,304 --a------ C:\WINDOWS\system32\E_FBCHACE.DLL
2008-09-24 19:21 . 2008-04-14 00:15 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-24 19:21 . 2008-04-14 00:15 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-24 19:21 . 2008-04-14 00:17 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-24 19:21 . 2008-04-14 00:17 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-24 19:21 . 2008-04-14 00:15 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-24 19:21 . 2008-04-14 00:15 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-24 19:20 . 2008-09-24 19:23 <DIR> d-------- C:\Program Files\epson
2008-09-24 19:20 . 2008-09-24 19:21 138,073 --a------ C:\WINDOWS\EPSTPLOG.BAK
2008-09-24 19:20 . 2005-02-25 00:00 46,080 --a------ C:\WINDOWS\system32\escimgd.dll
2008-09-24 19:20 . 2005-02-25 00:00 29,696 --a------ C:\WINDOWS\system32\escwiad.dll
2008-09-24 19:20 . 2005-02-25 00:00 22,016 --a------ C:\WINDOWS\system32\esccmd.dll
2008-09-24 18:58 . 2008-09-27 08:53 <DIR> d-------- C:\!KillBox
2008-09-24 18:54 . 2008-09-24 18:54 26 --a------ C:\WINDOWS\Lic.xxx
2008-09-24 18:53 . 2008-04-14 08:52 147,968 --a------ C:\WINDOWS\R.COM
2008-09-24 18:53 . 2008-04-14 08:52 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-09-24 18:51 . 2008-09-24 18:51 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-24 18:32 . 2008-09-24 18:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-09-24 18:31 . 2008-09-24 18:40 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-24 15:26 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Media Player Classic
2008-09-24 15:26 . 2008-09-24 15:26 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-23 21:34 . 2008-09-23 21:34 36 --a------ C:\WINDOWS\usdthank.ini
2008-09-23 21:34 . 2008-09-23 21:34 31 --a------ C:\WINDOWS\idc.ini
2008-09-23 21:10 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Mozilla
2008-09-23 16:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Chromeflower
2008-09-23 16:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\CrystalSpace
2008-09-23 16:07 . 2008-09-23 16:07 <DIR> d-------- C:\Program Files\TeddyBears
2008-09-22 22:30 . 2008-09-22 22:30 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-22 20:13 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Nero
2008-09-22 19:15 . 2008-06-23 18:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-22 19:15 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-22 19:15 . 2007-03-08 07:09 1,024,000 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-22 19:15 . 2008-06-23 18:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-22 19:15 . 2008-06-23 18:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-22 19:15 . 2008-06-23 18:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-22 19:15 . 2008-06-23 18:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-22 19:15 . 2008-06-23 18:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-22 19:15 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-22 13:25 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\skypePM
2008-09-22 13:24 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Skype
2008-09-22 13:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Macromedia
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Identities
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\ESET
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\ATI
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Adobe
2008-09-22 13:02 . 2008-09-21 21:36 <DIR> d--h----- C:\Documents and Settings\Pavla\ćablony
2008-09-22 13:02 . 2008-09-26 21:22 <DIR> d-------- C:\Documents and Settings\Pavla\Plocha
2008-09-22 13:02 . 2008-09-21 23:31 <DIR> d--h----- C:\Documents and Settings\Pavla\Okolnˇ tisk rny
2008-09-22 13:02 . 2008-09-24 09:52 <DIR> d--h----- C:\Documents and Settings\Pavla\Okolnˇ sˇś
2008-09-22 13:02 . 2008-09-26 19:06 <DIR> dr------- C:\Documents and Settings\Pavla\Oblˇben‚ polo§ky
2008-09-22 13:02 . 2008-09-21 23:31 <DIR> dr------- C:\Documents and Settings\Pavla\Nabˇdka Start
2008-09-22 13:02 . 2008-09-22 13:03 <DIR> dr------- C:\Documents and Settings\Pavla\Dokumenty
2008-09-22 13:02 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Microsoft
2008-09-22 13:02 . 2008-09-23 21:10 <DIR> dr-h----- C:\Documents and Settings\Pavla\Data aplikacˇ
2008-09-22 13:02 . 2008-09-26 23:12 <DIR> d-------- C:\Documents and Settings\Pavla
2008-09-22 10:53 . <DIR> C:\Documents and Settings\Tony\Data aplikací\ICQ
2008-09-22 10:52 . 2008-09-24 15:12 <DIR> d-------- C:\Program Files\ICQ6
2008-09-22 10:45 . 2008-09-22 10:45 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-22 10:43 . 2008-09-22 10:43 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-22 10:43 . 2008-04-14 08:52 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-22 10:42 . 2008-09-22 10:42 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-22 10:42 . 2008-09-22 10:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-22 10:40 . 2008-09-22 10:41 <DIR> d-------- C:\Program Files\The KMPlayer1431
2008-09-22 09:56 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Nero
2008-09-22 09:52 . 2008-09-25 19:58 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-09-22 09:29 . 2008-09-26 08:03 24 ---hs---- C:\WINDOWS\SA6E5241C.tmp
2008-09-22 09:24 . 2008-09-22 09:24 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-09-22 09:16 . 2008-09-26 23:11 <DIR> d-------- C:\Program Files\SMS posˇlaź Treca
2008-09-22 00:02 . <DIR> C:\Documents and Settings\Tony\Data aplikací\WinRAR
2008-09-21 22:59 . 2008-09-21 22:59 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-09-21 22:56 . 2008-09-21 22:57 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-09-21 22:56 . 2008-09-21 22:56 <DIR> dr-h----- C:\MSOCache
2008-09-21 22:53 . 2008-09-21 22:54 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-09-21 22:53 . 2008-09-21 22:53 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-09-21 22:53 . 2008-09-21 22:53 <DIR> d-------- C:\Program Files\MSBuild
2008-09-21 22:53 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-09-21 22:38 . 2008-09-21 22:38 <DIR> d-------- C:\Program Files\VIA
2008-09-21 22:38 . 2008-06-14 19:35 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-21 22:37 . 2008-09-22 22:36 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-21 22:37 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-21 22:37 . 2008-05-01 16:37 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-21 22:37 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-21 22:33 . 2008-09-21 22:33 <DIR> d-------- C:\Program Files\Marvell
2008-09-21 22:29 . 2008-09-21 22:29 <DIR> d-------- C:\Program Files\ASUS
2008-09-21 22:26 . 2008-09-21 22:26 <DIR> d-------- C:\Program Files\7-Zip

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 21:11 --------- d-----w C:\Program Files\SMS posílač Treca
2008-09-26 21:11 --------- d-----w C:\Program Files\Katalog filmů
2008-09-26 19:34 --------- d-s---w C:\Documents and Settings\Tony\Data aplikací\Microsoft
2008-09-25 16:51 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\skypePM
2008-09-25 16:51 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Skype
2008-09-24 17:37 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-09-24 16:54 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Adobe
2008-09-23 14:10 --------- d--h--r C:\Documents and Settings\Pavla\Data aplikací\Chromeflower
2008-09-21 21:44 --------- d-----w C:\Program Files\Yahoo!
2008-09-21 21:41 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\ATI
2008-09-21 21:24 --------- d-----w C:\Program Files\Skype
2008-09-21 21:24 --------- d-----w C:\Program Files\Common Files\Skype
2008-09-21 21:08 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\ESET
2008-09-21 21:05 --------- d-----w C:\Program Files\Java
2008-09-21 21:05 --------- d-----w C:\Program Files\Common Files\Java
2008-09-21 21:04 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Macromedia
2008-09-21 21:01 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Mozilla
2008-09-21 21:00 --------- d-----w C:\Program Files\Microsoft Works
2008-09-21 19:47 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Identities
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:39 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-21 04:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-08-21 02:19 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-08-21 02:18 314,880 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-08-21 02:08 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-08-21 02:08 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-08-21 02:07 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-08-21 02:07 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-08-21 02:07 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-08-21 02:05 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-08-21 02:04 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-08-21 02:01 10,084,352 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-08-21 01:55 4,094,560 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-08-21 01:50 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-08-21 01:38 2,377,856 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-08-21 01:23 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-08-21 01:19 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-08-21 01:18 37,376 ----a-w C:\WINDOWS\system32\atiadlxx.dll
2008-08-21 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-08-21 01:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-08-21 01:17 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-08-21 01:11 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-08-05 21:14 90,112 ----a-w C:\WINDOWS\system32\ATIBRTMON.EXE
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-09-24 20480]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"EPSON Stylus DX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 217088]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Tony\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-19 4742184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\ESET\\ESET Smart Security\\egui.exe"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\USD\\USDownloader.exe"=
"C:\\USD\\update.bat"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\CounterPath\\X-Lite\\x-lite.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 77312]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2008-04-14 69120]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 09:22:10
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2008-09-27 9:22:58
ComboFix-quarantined-files.txt 2008-09-27 07:22:36
ComboFix2.txt 2008-09-26 23:08:37

Před spuštěním: Volněch bajt…: 18˙327˙916˙544
Po spuštění: Volněch bajt…: 18,386,067,456

267 --- E O F --- 2008-09-26 21:45:49


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:24:24, on 27.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

--
End of file - 5750 bytes
Nahoru
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43295
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: prosim o pomoc!!!

Příspěvekod jaro3 » 27 zář 2008 12:03

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
C:\WINDOWS\system32\tmp.reg

Postupuj stejně jako výše:
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený přejmenovaný program ComboFix.exe a když se oba soubory překryjí, skript upusť
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT+zprávu o chování compu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

Re: prosim o pomoc!!!

Příspěvekod skerena » 27 zář 2008 12:09

Diky, udelam to, ted jsem dokoncil scan systemu antivirem Avir.
Log zde:



Avira AntiVir Premium
Report file date: 27. září 2008 10:59

Scanning for 1645581 virus strains and unwanted programs.

Licensed to: freddy fre
Serial number: 1101911578-PEPWE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: RODINA-XK4VQINI

Version information:
BUILD.DAT : 8.1.0.367 20012 Bytes 12.8.2008 11:31:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26.6.2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26.5.2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12.6.2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26.5.2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18.7.2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24.6.2008 13:54:15
ANTIVIR2.VDF : 7.0.6.217 3773440 Bytes 26.9.2008 08:36:59
ANTIVIR3.VDF : 7.0.6.218 2048 Bytes 26.9.2008 08:36:59
Engineversion : 8.1.1.35
AEVDF.DLL : 8.1.0.5 102772 Bytes 25.2.2008 09:58:21
AESCRIPT.DLL : 8.1.0.76 319867 Bytes 27.9.2008 08:37:06
AESCN.DLL : 8.1.0.23 119156 Bytes 10.7.2008 12:44:49
AERDL.DLL : 8.1.1.2 438644 Bytes 27.9.2008 08:37:05
AEPACK.DLL : 8.1.2.3 364918 Bytes 27.9.2008 08:37:05
AEOFFICE.DLL : 8.1.0.25 196986 Bytes 27.9.2008 08:37:04
AEHEUR.DLL : 8.1.0.59 1438071 Bytes 27.9.2008 08:37:04
AEHELP.DLL : 8.1.0.15 115063 Bytes 10.7.2008 12:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 27.9.2008 08:37:01
AEEMU.DLL : 8.1.0.7 430452 Bytes 31.7.2008 08:33:21
AECORE.DLL : 8.1.1.11 172406 Bytes 27.9.2008 08:37:00
AEBB.DLL : 8.1.0.1 53617 Bytes 10.7.2008 12:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 9.7.2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16.5.2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 27.9.2008 08:37:00
AVREG.DLL : 8.0.0.1 33537 Bytes 9.5.2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12.2.2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12.6.2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22.1.2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12.6.2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25.1.2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2564353 Bytes 12.6.2008 13:29:30
RCTEXT.DLL : 8.0.51.0 86273 Bytes 27.6.2008 11:00:56

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition premium\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, G:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 27. září 2008 10:59

Starting search for hidden objects.
'40305' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'avwebgrd.exe' - '1' Module(s) have been scanned
Scan process 'avmailc.exe' - '1' Module(s) have been scanned
Scan process 'avesvc.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'CCC.exe' - '1' Module(s) have been scanned
Scan process 'YahooWidgets.exe' - '1' Module(s) have been scanned
Scan process 'YahooWidgets.exe' - '1' Module(s) have been scanned
Scan process 'YahooWidgets.exe' - '1' Module(s) have been scanned
Scan process 'FxSvr2.exe' - '1' Module(s) have been scanned
Scan process 'backWeb-8876480.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'LogiTray.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'E_FATIACE.EXE' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'MOM.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'G:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '61' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <data>
D:\System Volume Information\_restore{BBA3B2B3-AFBE-46DE-AB86-66BA462C6A07}\RP980\A0173566.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.fwm back-door program
[NOTE] The file was moved to '490f0013.qua'!
D:\System Volume Information\_restore{BBA3B2B3-AFBE-46DE-AB86-66BA462C6A07}\RP982\A0176673.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.fwm back-door program
[NOTE] The file was moved to '490f0019.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP13\A0014116.exe
[DETECTION] Contains recognition pattern of the WORM/Spybot.1135616 worm
[NOTE] The file was moved to '490e0079.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP2\A0000248.exe
[DETECTION] Contains recognition pattern of the ADSPY/Whenu.A.1 adware or spyware
[NOTE] The file was moved to '490e0083.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP27\A0021716.exe
[DETECTION] Is the TR/Agent.69632.O Trojan
[NOTE] The file was moved to '490e0089.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP27\A0021719.exe
[DETECTION] Is the TR/Crypt.F.Gen Trojan
[NOTE] The file was moved to '490e0094.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP27\A0021721.exe
[DETECTION] Is the TR/Proxy.Ranky.G.1 Trojan
[NOTE] The file was moved to '490e0098.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP27\A0021723.exe
[DETECTION] Is the TR/Proxy.Ranky.G.1 Trojan
[NOTE] The file was moved to '490e009d.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP28\A0021828.EXE
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Agent.dza back-door program
[NOTE] The file was moved to '490e00a4.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP32\A0022243.EXE
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Agent.dza back-door program
[NOTE] The file was moved to '490e00ac.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP35\A0023469.exe
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE] The file was moved to '490e00b4.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP36\A0024760.exe
[DETECTION] Is the TR/Drop.Agent.459264 Trojan
[NOTE] The file was moved to '490e00e6.qua'!
D:\System Volume Information\_restore{D2A24E80-B116-490F-863E-7585B9A01F77}\RP7\A0010099.exe
[DETECTION] Is the TR/Keygen.Q.11 Trojan
[NOTE] The file was moved to '490e00f0.qua'!
D:\System Volume Information\_restore{D82B9088-9BDE-4FD0-8235-5C30EE122746}\RP16\A0004223.exe
[WARNING] An exception has been identified!
[WARNING] In the module 'aecore.dll' an exception occured.
Calling the function AVEPROC_TestFile in file: \\?\D:\System Volume Information\_restore{D82B9088-9BDE-4FD0-8235-5C30EE122746}\RP16\A0004223.exe
Error description:ACCESS_VIOLATION
EAX = 076D21B8 EBX = 0126EAD0
ECX = 076D2194 EDX = 000001FB
ESI = 06EA25C8 EDI = 0126eacc
EIP = 013AC903 EBP = 076A007C
ESP = 01C9EC70 Flg = 00010283
CS = 00000023 SS = 0000001B
D:\System Volume Information\_restore{D82B9088-9BDE-4FD0-8235-5C30EE122746}\RP35\A0006663.exe
[WARNING] An exception has been identified!
[WARNING] In the module 'aecore.dll' an exception occured.
Calling the function AVEPROC_TestFile in file: \\?\D:\System Volume Information\_restore{D82B9088-9BDE-4FD0-8235-5C30EE122746}\RP35\A0006663.exe
Error description:ACCESS_VIOLATION
EAX = 09C421B8 EBX = 02AA8A98
ECX = 09C42194 EDX = 000001FB
ESI = 094125C8 EDI = 02aa8a94
EIP = 013AC903 EBP = 09C1007C
ESP = 01C9EC70 Flg = 00010283
CS = 00000023 SS = 0000001B
Begin scan in 'G:\' <data>
G:\sdílení\SOWT\clear!.rar
[0] Archive type: RAR
--> clear!\ComboFix.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.YE back-door program
[WARNING] The file was ignored!
G:\sdílení\SOWT\convertxtodvd.v2.0.9.119-patch.exe
[DETECTION] Is the TR/Agent.69286 Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\CopyToDVD.v4.0.0.38b.WinALL.Incl.Crack-TE.rar
[0] Archive type: RAR
--> copytodvd4_setup.exe
[1] Archive type: RSRC
--> Object
[DETECTION] Is the TR/Dldr.Spacdan.A.2 Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\DVDFab platinum_Patch.exe
[DETECTION] Is the TR/Delf.cwu.1 Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\KEYGEN - NERO 8.rar
[0] Archive type: RAR
--> KEYGEN - NERO 8\Black_X.rar
[1] Archive type: RAR
--> Black_X\Nero 8.XX.exe
[DETECTION] Is the TR/Agent.62976.R Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\KEYGEN_-_NERO_8.rar
[0] Archive type: RAR
--> KEYGEN - NERO 8\Black_X.rar
[1] Archive type: RAR
--> Black_X\Nero 8.XX.exe
[DETECTION] Is the TR/Agent.62976.R Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\Open.Video.Joiner.v3.0.3.Incl.Keymaker-brd.rar
[0] Archive type: RAR
--> ovideojoiner.exe
[DETECTION] Is the TR/Crypt.CFI.Gen Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\Slysoft CloneCD v5.3.1.0 [ICU Patch][h33t][matt14].rar
[0] Archive type: RAR
--> Slysoft CloneCD v5.3.1.0 [ICU Patch][h33t][matt14]\clone.cd.5.3.1.0-patch.exe
[DETECTION] Is the TR/Patch.EP Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\SlySoft.AnyDVD.HD.6.3.0.3.zip
[0] Archive type: ZIP
--> crack.exe
[DETECTION] Contains recognition pattern of the ADSPY/Shopper.Y adware or spyware
[WARNING] The file was ignored!
G:\sdílení\SOWT\UltraISO 8.0 + crack.rar
[0] Archive type: RAR
--> UltraISO 8.0 + crack\keygen.exe
[DETECTION] Is the TR/Spy.73117 Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\USD-Blackmanos-13_60.rar
[WARNING] An exception has been identified!
[WARNING] In the module 'aecore.dll' an exception occured.
Calling the function AVEPROC_TestFile in file: \\?\G:\sdílení\SOWT\USD-Blackmanos-13_60.rar
Error description:ACCESS_VIOLATION
EAX = 0E0721B8 EBX = 01ED9A78
ECX = 0E072194 EDX = 000001FB
ESI = 0D8425C8 EDI = 01ed9a74
EIP = 013AC903 EBP = 0E04007C
ESP = 01C9EE8C Flg = 00010283
CS = 00000023 SS = 0000001B
G:\sdílení\SOWT\WR_3.71+key.exe
[0] Archive type: RAR SFX (self extracting)
--> WR_3.71+key\winrar.3.7x.multilangue-patch.exe
[DETECTION] Is the TR/Agent.63488.BS Trojan
[WARNING] The file was ignored!
G:\sdílení\SOWT\WinASO Registry Optimizer\WinASO Registry Optimizer\KEYGEN, PATCH\keygen.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[WARNING] The file was ignored!


End of the scan: 27. září 2008 11:57
Used time: 58:20 Minute(s)

The scan has been done completely.

6748 Scanning directories
227249 Files were scanned
24 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
0 files were deleted
0 files were repaired
13 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
227223 Files not concerned
4276 Archives were scanned
16 Warnings
13 Notes
40305 Objects were scanned with rootkit scan
0 Hidden objects were found
Nahoru
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

Re: prosim o pomoc!!!

Příspěvekod skerena » 27 zář 2008 12:16

ComboFix 08-09-26.01 - Tony 2008-09-27 12:04:08.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.582 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Tony\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\Tony\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
C:\WINDOWS\system32\tmp.reg
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\tmp.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-08-27 do 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-09-27 10:40 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Avira
2008-09-27 10:36 . 2008-09-27 10:36 <DIR> d-------- C:\Program Files\Avira
2008-09-27 09:08 . 2008-09-27 09:08 <DIR> d-------- C:\Program Files\WinASO
2008-09-27 09:00 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Uniblue
2008-09-26 23:29 . 2008-04-14 08:49 102,912 -----c--- C:\WINDOWS\system32\dllcache\dpcdll.dll
2008-09-26 23:15 . 2008-09-27 08:43 8,224 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-09-26 03:00 . 2008-09-26 23:06 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-09-25 21:17 . 2008-09-26 23:11 <DIR> d-------- C:\Program Files\Katalog film…
2008-09-25 21:17 . 2008-09-25 21:17 <DIR> d-------- C:\Program Files\Common Files\Borland Shared
2008-09-25 21:17 . 1999-01-20 05:01 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL
2008-09-25 21:17 . 1999-11-12 05:11 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL
2008-09-25 21:17 . 2008-09-26 21:18 13,030 --a------ C:\PDOXUSRS.NET
2008-09-25 19:57 . 2008-09-25 19:57 <DIR> d-------- C:\Program Files\Nero
2008-09-25 19:42 . 2008-09-25 19:44 <DIR> d-------- C:\Program Files\Your Uninstaller 2008
2008-09-25 19:42 . <DIR> C:\Documents and Settings\Tony\Data aplikací\URSoft
2008-09-25 03:48 . 2008-04-14 08:51 10,752 --------- C:\WINDOWS\system32\smtpapi.dll
2008-09-25 03:48 . 2008-04-14 08:51 9,728 --------- C:\WINDOWS\system32\rwnh.dll
2008-09-25 03:40 . 2008-04-14 00:15 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-24 21:38 . 2008-06-24 13:45 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-09-24 21:38 . 2008-06-23 17:36 773,120 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-09-24 21:15 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Ashampoo
2008-09-24 20:24 . 2008-09-24 20:25 <DIR> d-------- C:\Program Files\FreeCommander
2008-09-24 19:44 . 2008-09-24 19:44 <DIR> d-------- C:\Program Files\CounterPath
2008-09-24 19:44 . 2008-09-24 19:44 <DIR> d-------- C:\Program Files\Common Files\Intel
2008-09-24 19:41 . 2008-04-14 08:52 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-09-24 19:41 . 2008-04-14 08:52 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
2008-09-24 19:41 . 2008-04-14 00:16 15,232 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-09-24 19:41 . 2008-04-14 00:16 15,232 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2008-09-24 19:41 . 2008-04-14 00:16 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-09-24 19:41 . 2008-04-14 00:16 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2008-09-24 19:41 . 2008-04-14 00:09 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-09-24 19:41 . 2008-04-14 00:09 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2008-09-24 19:39 . <DIR> C:\Documents and Settings\Tony\Data aplikací\FotoWire
2008-09-24 19:38 . 2008-09-24 19:38 <DIR> d-------- C:\Program Files\Common Files\FotoWire
2008-09-24 19:38 . 2004-10-08 12:46 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2008-09-24 19:37 . 2008-09-24 19:38 <DIR> d-------- C:\Program Files\Logitech
2008-09-24 19:37 . 2008-09-24 19:37 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-09-24 19:21 . 2004-11-25 07:07 79,679 --a------ C:\WINDOWS\system32\E_FLMACE.DLL
2008-09-24 19:21 . 2003-05-21 05:27 64,000 --a------ C:\WINDOWS\system32\E_FBCBACE.DLL
2008-09-24 19:21 . 2004-09-10 23:12 49,152 --a------ C:\WINDOWS\system32\E_DCINST.DLL
2008-09-24 19:21 . 2000-06-07 04:01 34,304 --a------ C:\WINDOWS\system32\E_FBCHACE.DLL
2008-09-24 19:21 . 2008-04-14 00:15 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-24 19:21 . 2008-04-14 00:15 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-24 19:21 . 2008-04-14 00:17 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-24 19:21 . 2008-04-14 00:17 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-24 19:21 . 2008-04-14 00:15 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-24 19:21 . 2008-04-14 00:15 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-24 19:20 . 2008-09-24 19:23 <DIR> d-------- C:\Program Files\epson
2008-09-24 19:20 . 2008-09-24 19:21 138,073 --a------ C:\WINDOWS\EPSTPLOG.BAK
2008-09-24 19:20 . 2005-02-25 00:00 46,080 --a------ C:\WINDOWS\system32\escimgd.dll
2008-09-24 19:20 . 2005-02-25 00:00 29,696 --a------ C:\WINDOWS\system32\escwiad.dll
2008-09-24 19:20 . 2005-02-25 00:00 22,016 --a------ C:\WINDOWS\system32\esccmd.dll
2008-09-24 18:58 . 2008-09-27 08:53 <DIR> d-------- C:\!KillBox
2008-09-24 18:54 . 2008-09-24 18:54 26 --a------ C:\WINDOWS\Lic.xxx
2008-09-24 18:53 . 2008-04-14 08:52 147,968 --a------ C:\WINDOWS\R.COM
2008-09-24 18:53 . 2008-04-14 08:52 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-09-24 18:51 . 2008-09-24 18:51 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-24 18:32 . 2008-09-24 18:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-09-24 18:31 . 2008-09-24 18:40 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-24 15:26 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Media Player Classic
2008-09-24 15:26 . 2008-09-24 15:26 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-23 21:34 . 2008-09-23 21:34 36 --a------ C:\WINDOWS\usdthank.ini
2008-09-23 21:34 . 2008-09-23 21:34 31 --a------ C:\WINDOWS\idc.ini
2008-09-23 21:10 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Mozilla
2008-09-23 16:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Chromeflower
2008-09-23 16:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\CrystalSpace
2008-09-23 16:07 . 2008-09-23 16:07 <DIR> d-------- C:\Program Files\TeddyBears
2008-09-22 22:30 . 2008-09-22 22:30 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-22 20:13 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Nero
2008-09-22 19:15 . 2008-06-23 18:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-22 19:15 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-22 19:15 . 2007-03-08 07:09 1,024,000 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-22 19:15 . 2008-06-23 18:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-22 19:15 . 2008-06-23 18:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-22 19:15 . 2008-06-23 18:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-22 19:15 . 2008-06-23 18:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-22 19:15 . 2008-06-23 18:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-22 19:15 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-22 13:25 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\skypePM
2008-09-22 13:24 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Skype
2008-09-22 13:09 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Macromedia
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Identities
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\ESET
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\ATI
2008-09-22 13:03 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Adobe
2008-09-22 13:02 . 2008-09-21 21:36 <DIR> d--h----- C:\Documents and Settings\Pavla\ćablony
2008-09-22 13:02 . 2008-09-26 21:22 <DIR> d-------- C:\Documents and Settings\Pavla\Plocha
2008-09-22 13:02 . 2008-09-21 23:31 <DIR> d--h----- C:\Documents and Settings\Pavla\Okolnˇ tisk rny
2008-09-22 13:02 . 2008-09-24 09:52 <DIR> d--h----- C:\Documents and Settings\Pavla\Okolnˇ sˇś
2008-09-22 13:02 . 2008-09-26 19:06 <DIR> dr------- C:\Documents and Settings\Pavla\Oblˇben‚ polo§ky
2008-09-22 13:02 . 2008-09-21 23:31 <DIR> dr------- C:\Documents and Settings\Pavla\Nabˇdka Start
2008-09-22 13:02 . 2008-09-22 13:03 <DIR> dr------- C:\Documents and Settings\Pavla\Dokumenty
2008-09-22 13:02 . <DIR> C:\Documents and Settings\Pavla\Data aplikací\Microsoft
2008-09-22 13:02 . 2008-09-23 21:10 <DIR> dr-h----- C:\Documents and Settings\Pavla\Data aplikacˇ
2008-09-22 13:02 . 2008-09-26 23:12 <DIR> d-------- C:\Documents and Settings\Pavla
2008-09-22 10:53 . <DIR> C:\Documents and Settings\Tony\Data aplikací\ICQ
2008-09-22 10:52 . 2008-09-24 15:12 <DIR> d-------- C:\Program Files\ICQ6
2008-09-22 10:45 . 2008-09-22 10:45 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-22 10:43 . 2008-09-22 10:43 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-22 10:43 . 2008-04-14 08:52 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-22 10:42 . 2008-09-22 10:42 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-22 10:42 . 2008-09-22 10:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-22 10:40 . 2008-09-22 10:41 <DIR> d-------- C:\Program Files\The KMPlayer1431
2008-09-22 09:56 . <DIR> C:\Documents and Settings\Tony\Data aplikací\Nero
2008-09-22 09:52 . 2008-09-25 19:58 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-09-22 09:29 . 2008-09-26 08:03 24 ---hs---- C:\WINDOWS\SA6E5241C.tmp
2008-09-22 09:24 . 2008-09-22 09:24 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-09-22 09:16 . 2008-09-26 23:11 <DIR> d-------- C:\Program Files\SMS posˇlaź Treca
2008-09-22 00:02 . <DIR> C:\Documents and Settings\Tony\Data aplikací\WinRAR
2008-09-21 22:59 . 2008-09-21 22:59 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-09-21 22:56 . 2008-09-21 22:57 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-09-21 22:56 . 2008-09-21 22:56 <DIR> dr-h----- C:\MSOCache
2008-09-21 22:53 . 2008-09-21 22:54 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-09-21 22:53 . 2008-09-21 22:53 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-09-21 22:53 . 2008-09-21 22:53 <DIR> d-------- C:\Program Files\MSBuild
2008-09-21 22:53 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-09-21 22:38 . 2008-09-21 22:38 <DIR> d-------- C:\Program Files\VIA
2008-09-21 22:38 . 2008-06-14 19:35 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-21 22:37 . 2008-09-22 22:36 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-21 22:37 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-21 22:37 . 2008-05-01 16:37 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-21 22:37 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-21 22:33 . 2008-09-21 22:33 <DIR> d-------- C:\Program Files\Marvell
2008-09-21 22:29 . 2008-09-21 22:29 <DIR> d-------- C:\Program Files\ASUS
2008-09-21 22:26 . 2008-09-21 22:26 <DIR> d-------- C:\Program Files\7-Zip

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 21:11 --------- d-----w C:\Program Files\SMS posílač Treca
2008-09-26 21:11 --------- d-----w C:\Program Files\Katalog filmů
2008-09-26 19:34 --------- d-s---w C:\Documents and Settings\Tony\Data aplikací\Microsoft
2008-09-25 16:51 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\skypePM
2008-09-25 16:51 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Skype
2008-09-24 17:37 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-09-24 16:54 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Adobe
2008-09-23 14:10 --------- d--h--r C:\Documents and Settings\Pavla\Data aplikací\Chromeflower
2008-09-21 21:44 --------- d-----w C:\Program Files\Yahoo!
2008-09-21 21:41 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\ATI
2008-09-21 21:24 --------- d-----w C:\Program Files\Skype
2008-09-21 21:24 --------- d-----w C:\Program Files\Common Files\Skype
2008-09-21 21:08 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\ESET
2008-09-21 21:05 --------- d-----w C:\Program Files\Java
2008-09-21 21:05 --------- d-----w C:\Program Files\Common Files\Java
2008-09-21 21:04 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Macromedia
2008-09-21 21:01 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Mozilla
2008-09-21 21:00 --------- d-----w C:\Program Files\Microsoft Works
2008-09-21 19:47 --------- d-----w C:\Documents and Settings\Tony\Data aplikací\Identities
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\NetworkService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:46 --------- d-s---w C:\Documents and Settings\LocalService\Data aplikací\Microsoft
2008-09-21 19:39 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-21 04:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-08-21 02:19 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-08-21 02:18 314,880 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-08-21 02:08 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-08-21 02:08 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-08-21 02:07 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-08-21 02:07 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-08-21 02:07 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-08-21 02:05 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-08-21 02:04 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-08-21 02:01 10,084,352 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-08-21 01:55 4,094,560 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-08-21 01:50 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-08-21 01:38 2,377,856 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-08-21 01:23 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-08-21 01:19 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-08-21 01:18 37,376 ----a-w C:\WINDOWS\system32\atiadlxx.dll
2008-08-21 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-08-21 01:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-08-21 01:17 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-08-21 01:11 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-08-05 21:14 90,112 ----a-w C:\WINDOWS\system32\ATIBRTMON.EXE
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

((((((((((((((((((((((((((((( snapshot@2008-09-27_ 9.22.26.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-12 10:29:14 94,465 ----a-w C:\WINDOWS\system32\avsda.dll
+ 2008-05-09 11:15:51 45,376 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 16:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-06-27 13:03:55 75,072 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 08:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-09-24 20480]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"EPSON Stylus DX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 217088]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Tony\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-19 4742184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\USD\\USDownloader.exe"=
"C:\\USD\\update.bat"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\CounterPath\\X-Lite\\x-lite.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 77312]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-11 164097]
R2 AntiVirScheduler;Avira AntiVir Premium Scheduler;C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe [2008-06-12 68865]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-06-12 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-05-09 41217]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2008-04-14 69120]

*Newly Created Service* - SSMDRV
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 12:06:05
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2008-09-27 12:06:59
ComboFix-quarantined-files.txt 2008-09-27 10:06:38
ComboFix2.txt 2008-09-27 07:22:59
ComboFix3.txt 2008-09-26 23:08:37

Před spuštěním: Volněch bajt…: 18˙246˙897˙664
Po spuštění: Volněch bajt…: 18,233,962,496

275 --- E O F --- 2008-09-26 21:45:49
Nahoru
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43295
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: prosim o pomoc!!!

Příspěvekod jaro3 » 27 zář 2008 12:21

Pošli ještě jednou log z HJT +info o chování compu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

Re: prosim o pomoc!!!

Příspěvekod skerena » 27 zář 2008 12:27

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18:16, on 27.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

--
End of file - 6669 bytes
Nahoru
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43295
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: prosim o pomoc!!!

Příspěvekod jaro3 » 27 zář 2008 12:35

Fix HJT:

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

Jak se chová comp??
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

Re: prosim o pomoc!!!

Příspěvekod skerena » 27 zář 2008 12:41

PC se chova normalne az na tu klavesnici, na ktere jednoduse nefunguji urcite klavesy ani v CZ ani v An.
Musim do prace, ozvu se v noci.
Dekuji ti!
Nahoru
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43295
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: prosim o pomoc!!!

Příspěvekod jaro3 » 27 zář 2008 12:46

Alt+Shift Ti funguje?Myslím přepínání znaků.Virama to asi nebude, můžeme ještě zkusit něco na malware, spíš vidím problém ve win, klávesnici. Možná něco s doinstalací SP3.Zkus znovu nainstalovat klávesnici.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
skerena
nováček
Příspěvky: 15
Registrován: srpen 08
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele skerena

Re: prosim o pomoc!!!

Příspěvekod skerena » 28 zář 2008 00:42

Děkuji ti za ochotu. Nakonec pomohlo zapojit novou, jinou klávesnici, načetly se ovladače a teď mi dokonce bezproblémově funguje i ta původní klávesnice!
Ještě jednou díky!
Nahoru
Odpovědět

Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 6 hostů