Prosím o kontrolu logu Vyřešeno

[redvo]

a tu je otestovaný AEE61F1FA7.dll, ak by trebalo nejaké iné zobrazenie stačí povedať


Antivirus;Verze;Poslední aktualizace;Výsledek
a-squared;4.0.0.73;2009.01.27;-
AhnLab-V3;5.0.0.2;2009.01.26;-
AntiVir;7.9.0.60;2009.01.27;-
Authentium;5.1.0.4;2009.01.26;-
Avast;4.8.1281.0;2009.01.27;-
AVG;8.0.0.229;2009.01.27;-
BitDefender;7.2;2009.01.27;-
CAT-QuickHeal;10.00;2009.01.27;-
ClamAV;0.94.1;2009.01.27;-
Comodo;948;2009.01.27;-
DrWeb;4.44.0.09170;2009.01.27;-
eSafe;7.0.17.0;2009.01.27;-
eTrust-Vet;31.6.6329;2009.01.27;-
F-Prot;4.4.4.56;2009.01.26;-
F-Secure;8.0.14470.0;2009.01.27;-
Fortinet;3.117.0.0;2009.01.27;-
GData;19;2009.01.27;-
Ikarus;T3.1.1.45.0;2009.01.27;-
K7AntiVirus;7.10.606;2009.01.26;-
Kaspersky;7.0.0.125;2009.01.27;-
McAfee;5507;2009.01.26;-
McAfee+Artemis;5507;2009.01.26;-
Microsoft;1.4205;2009.01.27;-
NOD32;3803;2009.01.27;-
Norman;5.93.01;2009.01.27;-
nProtect;2009.1.8.0;2009.01.27;-
Panda;9.5.1.2;2009.01.27;-
PCTools;4.4.2.0;2009.01.27;-
Prevx1;V2;2009.01.27;-
Rising;21.13.42.00;2009.01.23;-
SecureWeb-Gateway;6.7.6;2009.01.27;-
Sophos;4.37.0;2009.01.27;-
Sunbelt;3.2.1835.2;2009.01.16;-
Symantec;10;2009.01.27;-
TheHacker;6.3.1.5.229;2009.01.26;-
TrendMicro;8.700.0.1004;2009.01.27;-
VBA32;3.12.8.11;2009.01.27;-
ViRobot;2009.1.23.1577;2009.01.26;-
VirusBuster;4.5.11.0;2009.01.26;-

Rozšiřující informace
File size: 80 bytes
MD5...: c78535f5d6ea93f5ad6050324a521759
SHA1..: 120fef92e618b3945e107607bc8668faa0ec3c32
SHA256: 8cfad28a0c8159164d00b2eef69ff4a3a9a5a7788d8f71d6b880eff59a4472e6
SHA512: f8a57bd09d164ab0b70679688adbec2db838c7e78fd911cf79909ddaff17e25b<br>b338447daf544cc06b821077e403d9b6dd7d960d646b347517f49ded1ef19868<br>
ssdeep: 3:slxz//tl9qH6QXZtRj:E58H6QX1j<br>
PEiD..: -
TrID..: File type identification<br>MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -

[Reklama]

[jaro3]

Je to O.k.(VT)
V logu se Ti objevilo toto:
c:\program files\KeenfinderSrch
To si sám instaloval?.....
Když ne , tak ještě script v CF:

Kód: Vybrat vše

Folder::
c:\program files\KeenfinderSrch


zase log z CF a HJT.

[redvo]

ospravedlňujem sa za čakanie tu sú logy

ComboFix

ComboFix 09-01-21.04 - Lukáš 2009-01-28 8:44:45.6 - NTFSx86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1033.18.766.339 [GMT 1:00]
Running from: c:\documents and settings\Lukáš\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lukáš\Desktop\CFScript.txt
AV: avast! antivirus 4.7.1098 [VPS 090127-0] *On-access scanning disabled* (Updated)
FW: Kerio Personal Firewall *enabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\KeenfinderSrch
c:\program files\KeenfinderSrch\keenfinder.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-28 )))))))))))))))))))))))))))))))
.

2009-01-28 08:26 . 2009-01-28 08:27 <DIR> d-------- c:\program files\GIMPPortable
2009-01-27 18:00 . 2009-01-27 18:00 <DIR> d-------- c:\program files\CCleaner
2009-01-26 22:41 . 2009-01-26 22:41 <DIR> d-------- C:\rsit
2009-01-26 11:50 . 2009-01-26 11:50 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-26 11:50 . 2009-01-26 11:50 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\Malwarebytes
2009-01-26 11:50 . 2009-01-26 11:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-26 11:50 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-26 11:50 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-26 08:50 . 2009-01-26 08:50 <DIR> d-------- c:\program files\Trend Micro
2009-01-19 15:20 . 2009-01-19 15:20 <DIR> d-------- c:\program files\TallStick
2009-01-19 14:38 . 2009-01-19 14:38 <DIR> d-------- c:\program files\WIDI 3.3 Pro
2009-01-19 14:38 . 2009-01-19 14:38 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\Music Recognition
2009-01-12 15:57 . 2008-08-29 13:59 3,883,008 --a------ c:\windows\system32\Tropix2.scr
2009-01-05 20:14 . 2009-01-05 20:14 <DIR> d-------- c:\program files\DAMN NFO Viewer
2009-01-04 12:22 . 2009-01-04 15:59 <DIR> d-------- c:\program files\MagicDisc
2009-01-04 12:22 . 2008-07-28 17:19 116,736 --a------ c:\windows\system32\drivers\mcdbus.sys
2009-01-02 10:23 . 2009-01-02 10:23 <DIR> d-------- c:\program files\ASIO4ALL v2
2009-01-02 10:23 . 2002-07-07 23:14 1,294,336 --a------ c:\windows\system32\vorbis.acm
2009-01-01 21:18 . 2009-01-01 21:18 <DIR> d-------- c:\program files\Native Instruments
2009-01-01 21:18 . 2009-01-01 21:18 <DIR> d-------- c:\program files\Common Files\Native Instruments
2009-01-01 21:18 . 2009-01-01 21:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Native Instruments
2009-01-01 21:18 . 2009-01-01 21:18 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{442B6EC3-77A0-4817-825F-67F47D7A2E54}
2009-01-01 21:18 . 2009-01-01 21:18 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{0D1E323F-9D1D-410B-9F3E-FBF24ECC2B05}
2009-01-01 09:09 . 2009-01-21 21:28 <DIR> d-------- c:\program files\Counter-Strike 1.6
2008-12-31 17:57 . 2004-07-09 04:26 1,230,336 --a--c--- c:\windows\system32\dllcache\msvidctl.dll
2008-12-31 17:57 . 2004-07-09 04:26 354,816 --a------ c:\windows\system32\psisdecd.dll
2008-12-31 17:57 . 2004-07-09 04:26 354,816 --a--c--- c:\windows\system32\dllcache\psisdecd.dll
2008-12-31 17:57 . 2004-07-09 04:26 52,224 --a------ c:\windows\system32\msdvbnp.ax
2008-12-31 17:57 . 2004-07-09 04:26 52,224 --a--c--- c:\windows\system32\dllcache\msdvbnp.ax
2008-12-31 17:57 . 2004-07-09 04:26 52,096 --a------ c:\windows\system32\drivers\msdv.sys
2008-12-31 17:57 . 2004-07-09 04:26 52,096 --a--c--- c:\windows\system32\dllcache\msdv.sys
2008-12-31 17:57 . 2004-07-09 04:26 47,104 --a--c--- c:\windows\system32\dllcache\wstdecod.dll
2008-12-31 17:57 . 2004-07-09 04:26 30,208 --a------ c:\windows\system32\psisrndr.ax
2008-12-31 17:57 . 2004-07-09 04:26 30,208 --a--c--- c:\windows\system32\dllcache\psisrndr.ax
2008-12-31 17:53 . 2008-12-31 19:30 <DIR> d-------- c:\program files\Microsoft Games
2008-12-30 10:03 . 2008-12-30 20:54 <DIR> d-------- c:\program files\Doggie Dash
2008-12-29 16:08 . 2008-12-30 20:53 <DIR> d-------- c:\program files\Snapshot Adventures
2008-12-29 14:20 . 2008-12-30 20:53 <DIR> d-------- c:\program files\Risk
2008-12-29 09:38 . 2008-12-29 09:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\FreshGames
2008-12-29 09:37 . 2008-12-29 10:09 <DIR> d-------- c:\program files\Ranch Rush
2008-12-28 17:40 . 2009-01-09 13:04 <DIR> d-------- c:\program files\Alice Greenfingers 2
2008-12-28 16:24 . 2008-12-28 16:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\InterAction studios
2008-12-28 15:50 . 2008-12-28 16:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\VirtualFarm
2008-12-28 12:08 . 2008-12-29 08:31 <DIR> d-------- c:\program files\Farm Frenzy
2008-12-28 11:35 . 2008-12-29 08:31 <DIR> d-------- c:\program files\Jet Jumper
2008-12-28 10:01 . 2008-12-29 14:20 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\iWin
2008-12-28 10:00 . 2008-12-29 08:32 <DIR> d-------- c:\program files\Family Feud Dream Home

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-27 21:13 --------- d-----w c:\documents and settings\Lukáš\Application Data\Skype
2009-01-27 18:59 --------- d-----w c:\documents and settings\Lukáš\Application Data\skypePM
2009-01-27 17:17 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-27 17:08 --------- d-----w c:\documents and settings\Lukáš\Application Data\Chessmaster Challenge
2009-01-26 21:22 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-01-26 07:53 16,844 ----a-w c:\windows\system32\drivers\fwdrv.err
2009-01-24 21:07 --------- d-----w c:\program files\Valve
2009-01-21 21:03 --------- d-----w c:\documents and settings\Lukáš\Application Data\uTorrent
2009-01-21 21:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-12 14:57 --------- d-----w c:\documents and settings\Lukáš\Application Data\Zylom
2009-01-12 14:56 --------- d-----w c:\program files\Zylom Games
2009-01-05 20:03 --------- d-----w c:\program files\EA GAMES
2009-01-05 19:26 --------- d-----w c:\documents and settings\Lukáš\Application Data\ICQ
2009-01-04 13:12 --------- d-----w c:\program files\MagicISO
2009-01-02 09:44 --------- d-----w c:\program files\VstPlugins
2009-01-02 09:44 --------- d-----w c:\program files\Image-Line
2008-12-31 18:50 --------- d-----w c:\documents and settings\Lukáš\Application Data\Microsoft Games
2008-12-31 16:56 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Games
2008-12-30 14:20 --------- d-----w c:\program files\Puzzle Quest
2008-12-30 13:06 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-30 12:54 409,600 ----a-w c:\windows\system32\wrap_oal.dll
2008-12-30 12:54 114,688 ----a-w c:\windows\system32\OpenAL32.dll
2008-12-30 09:03 --------- d-----w c:\documents and settings\Lukáš\Application Data\PlayFirst
2008-12-30 09:03 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2008-12-29 07:31 --------- d-----w c:\program files\Pet Shop Hop
2008-12-28 13:48 --------- d-----w c:\documents and settings\Lukáš\Application Data\GetRightToGo
2008-12-27 18:00 --------- d-----w c:\program files\Rollercoaster Rush
2008-12-27 18:00 --------- d-----w c:\program files\Crazy Penguin Catapult
2008-12-27 17:53 --------- d-----w c:\program files\Heavy Weapon
2008-12-27 17:52 --------- d-----w c:\program files\Sallys Salon
2008-12-27 17:52 --------- d-----w c:\program files\Farm Craft
2008-12-27 17:52 --------- d-----w c:\program files\Cooking Academy
2008-12-27 17:51 --------- d-----w c:\program files\Puppy Luv
2008-12-27 16:41 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2008-12-27 13:49 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-27 13:49 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-12-27 09:29 --------- d-----w c:\program files\Bus Driver
2008-12-27 08:10 --------- d-----w c:\documents and settings\All Users\Application Data\NevoSoft Games
2008-12-26 13:02 --------- d-----w c:\documents and settings\Lukáš\Application Data\Reflexive Ashtons Family Resort
2008-12-26 13:02 --------- d-----w c:\documents and settings\All Users\Application Data\Reflexive Ashtons Family Resort
2008-12-25 19:45 --------- d-----w c:\program files\Sony Ericsson
2008-12-25 15:26 --------- d-----w c:\program files\QuickTime
2008-12-25 15:25 --------- d-----w c:\program files\Common Files\Apple
2008-12-25 15:25 --------- d-----w c:\program files\Apple Software Update
2008-12-25 15:25 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-24 20:53 --------- d-----w c:\program files\Media Art
2008-12-19 07:04 --------- d-----w c:\program files\OpenAL
2008-12-18 18:15 --------- d-----w c:\program files\uTorrent
2008-12-18 18:06 --------- d-----w c:\documents and settings\Lukáš\Application Data\DAEMON Tools Pro
2008-12-18 18:06 --------- d-----w c:\documents and settings\Lukáš\Application Data\DAEMON Tools Lite
2008-12-18 18:06 --------- d-----w c:\documents and settings\Lukáš\Application Data\DAEMON Tools
2008-12-18 18:05 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-18 18:05 --------- d-----w c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2008-12-18 10:23 --------- d-----w c:\program files\Tower Bloxx Deluxe
2008-12-17 19:32 --------- d-----w c:\documents and settings\Lukáš\Application Data\Hide IP NG
2008-12-17 14:33 --------- d-----w c:\program files\Farm Mania
2008-12-17 14:32 1,880 ----a-w c:\documents and settings\Lukáš\Application Data\mindhabits.dat
2008-12-17 14:20 --------- d-----w c:\program files\Got Game Entertainment
2008-12-17 08:19 --------- d-----w c:\documents and settings\All Users\Application Data\DigitalChocolate
2008-12-17 07:50 --------- d-----w c:\program files\Google
2008-12-16 09:35 --------- d-----w c:\program files\Xilisoft
2008-12-15 09:43 --------- d-----w c:\program files\1C
2008-12-15 09:29 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-14 17:53 --------- d-----w c:\program files\DVDVideoSoft
2008-12-13 08:07 --------- d-----w c:\program files\Eidos
2008-12-12 07:06 --------- d-----w c:\program files\DivX
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-10 08:21 --------- d-----w c:\program files\Glamus
2008-12-09 16:58 --------- d-----w c:\program files\ICQ6.5
2008-12-08 20:20 --------- d-----w c:\program files\ICQ6Toolbar
2008-12-08 17:36 --------- d-----w c:\documents and settings\Lukáš\Application Data\Uniblue
2008-12-07 15:53 --------- d-----w c:\program files\FileSubmit
2008-12-06 18:39 --------- d-----w c:\program files\IZArc
2008-12-06 17:34 --------- d-----w c:\program files\Windows Media Connect 2
2008-12-06 17:34 --------- d-----w c:\program files\Microsoft Plus! Digital Media Edition
2008-12-06 11:09 --------- d-----w c:\program files\Hewlett-Packard
2008-12-06 11:09 --------- d-----w c:\documents and settings\All Users\Application Data\HP Product Assistant
2008-12-06 11:09 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-06 10:33 --------- d-----w c:\documents and settings\Lukáš\Application Data\HP
2008-12-06 10:32 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2008-12-06 10:31 --------- d-----w c:\program files\HP
2008-12-06 10:31 --------- d-----w c:\documents and settings\All Users\Application Data\HPSSUPPLY
2008-12-06 10:30 --------- d-----w c:\documents and settings\Lukáš\Application Data\HPAppData
2008-12-06 10:29 --------- d-----w c:\program files\Common Files\HP
2008-12-06 10:29 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2008-12-06 10:27 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2008-12-06 07:39 --------- d-----w c:\program files\Arcade Lab
2008-12-04 18:46 --------- d-----w c:\program files\Zoner
2008-12-04 18:45 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-04 16:43 --------- d-----w c:\program files\ICQ620_08_49
2008-12-04 16:35 --------- d-----w c:\program files\Skype
2008-12-04 16:35 --------- d-----w c:\program files\Common Files\Skype
2008-12-04 16:35 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-04 16:30 --------- d-----w c:\documents and settings\All Users\Application Data\ICQ
2008-12-04 15:19 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-04 12:49 2,864 ----a-w c:\windows\system32\winsock.dll
2008-12-04 11:19 --------- d-----w c:\program files\Sibelius Software
2008-12-04 11:10 --------- d-----w c:\program files\Macromedia
2008-12-04 11:10 --------- d-----w c:\program files\Common Files\Macromedia
2008-12-04 10:57 --------- d-----w c:\program files\3DO
2007-09-26 15:13 80 --sh--r c:\windows\system32\AEE61F1FA7.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-27_ 8.58.28.93 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\erdnt\subs\ERDNT.EXE
+ 2009-01-28 07:12:57 16,384 ----atw c:\windows\TEMP\Perflib_Perfdata_5b4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" [2008-11-30 172792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"tsnp325"="c:\windows\tsnp325.exe" [2006-10-10 270336]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 79224]
"snp325"="c:\windows\vsnp325.exe" [2006-10-10 827392]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"VTTimer"="VTTimer.exe" [2006-06-16 c:\windows\system32\VTTimer.exe]
"S3Trayp"="S3Trayp.exe" [2005-10-31 c:\windows\system32\S3Trayp.exe]
"Realtime Audio Engine"="mmrtkrnl.exe" [2007-07-18 c:\windows\system32\mmrtkrnl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Luk ç\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-01-04 575488]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-21 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ |˜„/Řű-Řk˜t/DţĂÍÖM\0ţĂÚÖM\0DţĂ\ţĂł×M\0DţĂ˜t/0Kl<F

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-08-22 11264]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2005-12-15 274432]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2005-12-15 81920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2006-10-10 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2007-02-27 55024]
R3 PSched;QoS Packet Scheduler;c:\windows\system32\drivers\psched.sys [2006-02-28 69120]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2007-08-22 808448]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [2007-12-24 10251904]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);c:\windows\system32\drivers\s716bus.sys [2008-06-07 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;c:\windows\system32\drivers\s716mdfl.sys [2008-06-07 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;c:\windows\system32\drivers\s716mdm.sys [2008-06-07 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s716mgmt.sys [2008-06-07 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);c:\windows\system32\drivers\s716nd5.sys [2008-06-07 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;c:\windows\system32\drivers\s716obex.sys [2008-06-07 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);c:\windows\system32\drivers\s716unic.sys [2008-06-07 98952]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
S3 w200bus;Sony Ericsson W200 driver (WDM);c:\windows\system32\drivers\w200bus.sys [2008-06-07 61504]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;c:\windows\system32\drivers\w200mdfl.sys [2008-06-07 9328]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;c:\windows\system32\drivers\w200mdm.sys [2008-06-07 97056]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;c:\windows\system32\drivers\w200obex.sys [2008-06-07 86368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-01-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-23 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []
.
- - - - ORPHANS REMOVED - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/
mLocal Page = "řxn
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
uInternet Settings,ProxyServer = socks=
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
IE: &Search - ?p=ZNfox000
FF - ProfilePath - c:\documents and settings\Lukáš\Application Data\Mozilla\Firefox\Profiles\bo8yv69j.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-28 08:49:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-861567501-1229272821-725345543-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:4d,c9,a8,cb,de,87,cb,49,f6,8b,07,31,db,51,08,49,54,b4,7b,27,d9,2b,02,
88,25,ed,72,bb,c2,9a,aa,ab,e5,eb,b9,b9,77,38,11,a2,17,9a,62,74,e5,9d,80,a9,\
"??"=hex:a6,39,de,02,d4,53,e5,2f,bd,7f,e5,e3,ce,0a,49,e4
.
Completion time: 2009-01-28 8:52:53
ComboFix-quarantined-files.txt 2009-01-28 07:52:48
ComboFix2.txt 2009-01-27 14:35:32
ComboFix3.txt 2009-01-27 08:00:41
ComboFix4.txt 2008-02-14 17:06:08
ComboFix5.txt 2009-01-28 07:43:37

Pre-Run: 157 193 330 688 bytes free
Post-Run: 20 adresárov, 157,178,445,824 voľných bajtov

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
297 --- E O F --- 2009-01-14 06:23:36



a HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:58:30, on 28. 1. 2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\S3Trayp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\tsnp325.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\mmrtkrnl.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=66022
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = "řxn
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Podpora odkazu pre aplikáciu Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3Trayp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Realtime Audio Engine] "mmrtkrnl.exe" /i
O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\RunOnce: [WMC_0] C:\WINDOWS\system32\cmd.exe /c """""C:\WINDOWS\inf\unregmp2.exe"" /ShowWMP"""
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Search - ?p=ZNfox000
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 9385 bytes

[jaro3]

Odinstaluj:
ICQToolBar
My Web Search

Poté
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\RunOnce: [WMC_0] C:\WINDOWS\system32\cmd.exe /c """""C:\WINDOWS\inf\unregmp2.exe"" /ShowWMP"""
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O8 - Extra context menu item: &Search - ?p=ZNfox000


ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.

Aktualizuj javu:
Java SE Runtime Environment 6u11
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u11-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
Vše.

[redvo]

Ok všetko prebehlo bez problémov Ďakujem

[jaro3]

Není zač, můžeš dát vyřešeno, fajfku.