Kontrola logu HJT Vyřešeno

[jaro3]

Nezbývá než toto.
Vypni rez. ochranu u Avastu, pak to musíme odmazat scriptem , až zítra...
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[Reklama]

[flashparkprd]

Zde je log:

ComboFix 09-02-18.01 - Patrik 2009-02-19 21:06:00.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1022.660 [GMT 1:00]
Spuštěný z: c:\documents and settings\Patrik\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090218-0] *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Patrik\Data aplikací\inst.exe
c:\windows\system32\AudFile.dll
c:\windows\system32\AutoRun.inf
c:\windows\system32\WMAFile.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-19 do 2009-02-19 )))))))))))))))))))))))))))))))
.

2009-02-19 13:19 . 2009-02-19 13:23 <DIR> d-------- c:\program files\Intelore
2009-02-16 17:06 . 2009-02-16 17:06 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\fizzy
2009-02-15 21:28 . 2009-02-15 21:28 250 --a------ c:\windows\gmer.ini
2009-02-15 15:57 . 2005-06-01 13:15 966,144 --a------ c:\windows\system32\AudioInfos.dll
2009-02-15 15:57 . 2006-11-18 13:38 200,704 --a------ c:\windows\system32\vbalExpBar6.ocx
2009-02-15 15:57 . 2005-01-10 14:54 116,296 --a------ c:\windows\system32\NCTWMAProfiles.prx
2009-02-15 11:49 . 2009-02-15 11:49 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\Malwarebytes
2009-02-15 11:49 . 2009-02-15 11:49 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2009-02-12 13:41 . 2008-04-14 03:09 566,784 --a------ c:\windows\system32\gpedit.dll
2009-02-12 13:41 . 2008-04-14 03:11 295,936 --a------ c:\windows\system32\appmgr.dll
2009-02-12 13:41 . 2008-04-14 03:11 199,680 --a------ c:\windows\system32\gptext.dll
2009-02-12 13:41 . 2008-04-14 03:11 167,936 --a------ c:\windows\system32\appmgmts.dll
2009-02-12 13:41 . 2008-04-14 03:11 124,928 --a------ c:\windows\system32\fde.dll
2009-02-12 13:41 . 2008-04-14 03:11 73,728 --a------ c:\windows\system32\fdeploy.dll
2009-02-12 13:41 . 2001-08-23 14:00 34,871 --a------ c:\windows\system32\gpedit.msc
2009-02-10 17:58 . 2009-02-10 17:58 <DIR> d-------- c:\documents and settings\Patrik\WINDOWS
2009-02-07 21:01 . 2009-02-07 21:01 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Ulead Systems
2009-02-07 20:47 . 2009-02-07 20:47 10 --a------ c:\windows\WININIT.INI
2009-02-07 19:44 . 2009-02-07 19:48 <DIR> d-------- c:\program files\The KMPlayer
2009-02-03 21:26 . 2009-02-03 21:26 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-03 21:26 . 2009-02-03 21:26 1,409 --a------ c:\windows\QTFont.for
2009-02-03 16:42 . 2009-02-03 16:42 <DIR> d-------- c:\windows\Lang
2009-02-02 20:26 . 2009-02-02 20:26 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\vsosdk
2009-02-02 19:48 . 2009-02-02 20:39 <DIR> d-------- c:\program files\DVDFab 5
2009-02-02 19:48 . 2009-02-02 19:48 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\Vso
2009-02-02 19:48 . 2009-02-02 19:48 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2009-02-02 19:48 . 2009-02-02 19:48 47,360 --a------ c:\documents and settings\Patrik\Data aplikací\pcouffin.sys
2009-02-01 20:59 . 2009-02-01 20:59 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\Obsidium
2009-02-01 20:58 . 2009-02-01 21:02 <DIR> d-------- c:\program files\Oront Burning Kit 2
2009-01-30 22:44 . 2009-01-30 22:45 70 --a------ c:\windows\hdkctnts.ini
2009-01-30 22:02 . 2009-02-19 19:05 517 --a------ c:\windows\ccleaner.ini
2009-01-29 21:48 . 2009-01-29 21:48 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\WEBREG
2009-01-29 21:46 . 2009-01-29 21:46 <DIR> d-------- c:\program files\Common Files\HP
2009-01-29 21:46 . 2009-01-29 21:46 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\HP
2009-01-29 21:45 . 2009-01-29 21:45 <DIR> d-------- c:\program files\Hewlett-Packard
2009-01-29 21:45 . 2009-01-29 21:45 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard
2009-01-29 21:45 . 2007-03-06 13:20 49,920 -ra------ c:\windows\system32\drivers\HPZid412.sys
2009-01-29 21:45 . 2007-03-06 13:20 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys
2009-01-29 21:44 . 2009-01-29 21:44 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Hewlett-Packard
2009-01-29 21:44 . 2007-03-15 15:39 958,464 -ra------ c:\windows\system32\hpotiop4.dll
2009-01-29 21:44 . 2007-03-15 15:39 675,840 -ra------ c:\windows\system32\hpowiax4.dll
2009-01-29 21:44 . 2007-03-06 13:20 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2009-01-29 21:44 . 2007-03-06 13:20 309,760 -ra------ c:\windows\system32\difxapi.dll
2009-01-29 21:44 . 2007-03-15 15:39 303,104 -ra------ c:\windows\system32\hpovst11.dll
2009-01-29 21:44 . 2007-03-29 00:29 267,864 -ra------ c:\windows\system32\hpzids01.dll
2009-01-29 21:44 . 2007-03-28 14:01 118,272 --a------ c:\windows\system32\hpz3l5ha.dll
2009-01-29 21:44 . 2007-03-06 13:20 21,568 -ra------ c:\windows\system32\drivers\HPZius12.sys
2009-01-29 21:44 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-01-29 21:44 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2009-01-29 21:41 . 2009-01-29 21:41 <DIR> d-------- c:\program files\HP
2009-01-29 21:38 . 2009-02-18 18:20 158,260 --a------ c:\windows\hpoins15.dat
2009-01-29 21:38 . 2007-12-12 21:02 1,039 --------- c:\windows\hpomdl15.dat
2009-01-29 21:20 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-29 21:20 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2009-01-28 22:16 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-01-28 22:11 . 2009-02-15 18:22 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-28 22:11 . 2009-01-28 22:11 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-28 22:11 . 2009-01-28 22:11 <DIR> d-------- c:\program files\MSBuild
2009-01-28 22:10 . 2009-01-28 22:53 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-28 22:10 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-01-28 22:10 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-01-28 22:10 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-01-28 22:10 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-01-28 22:10 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-28 22:10 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-01-28 22:10 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-26 18:28 . 2009-01-26 18:28 121 --a------ c:\windows\Winchat.ini
2009-01-22 13:05 . 2004-06-06 22:42 45,952 --a------ c:\windows\system32\drivers\filedisk.sys
2009-01-20 17:00 . 2009-01-20 17:00 1,451,248 --a------ c:\windows\Cleaner.exe
2009-01-19 18:31 . 2007-01-18 13:00 3,968 --a------ c:\windows\system32\drivers\AvgArCln.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-15 15:02 --------- d-----w c:\program files\Free Easy Burner
2009-02-12 12:06 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Data aplikací\TEMP
2009-02-07 20:08 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 20:00 --------- d-----w c:\program files\Kobra 11 Nitro
2009-01-31 08:43 --------- d-----w c:\program files\ATI Technologies
2009-01-30 20:46 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Spybot - Search & Destroy
2009-01-18 12:11 3,888 ----a-w c:\windows\system32\drivers\NTHANDLE.SYS
2009-01-18 10:19 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\2BrightSparks
2009-01-17 17:06 --------- d-----w c:\documents and settings\Patrik\Data aplikací\ConvertTemp
2009-01-16 17:49 --------- d-----w c:\program files\Databaze_DVD_filmu
2009-01-16 13:43 --------- d-----w c:\program files\Common Files\Logitech
2009-01-15 17:25 --------- d-----w c:\program files\Common Files\Soft602
2009-01-13 15:31 796,672 ----a-w c:\windows\GPInstall.exe
2009-01-12 15:00 --------- d-----w c:\program files\Microsoft.NET
2009-01-10 22:28 --------- d-----w c:\documents and settings\Patrik\Data aplikací\Windows Search
2009-01-10 22:05 --------- d-----w c:\documents and settings\Táta\Data aplikací\Windows Desktop Search
2009-01-10 22:03 --------- d-----w c:\program files\Windows Desktop Search
2009-01-10 22:03 --------- d-----w c:\documents and settings\Patrik\Data aplikací\Windows Desktop Search
2009-01-10 14:09 --------- d-----w c:\documents and settings\Patrik\Data aplikací\Console
2009-01-05 15:09 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Trymedia
2009-01-04 12:08 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Alternate
2009-01-03 22:14 94 --sh--w c:\program files\desktop.ini
2009-01-03 08:07 81,920 ----a-w c:\windows\system32\frapsvid.dll
2009-01-02 22:16 --------- d-----w c:\program files\Servant Salamander 2.0
2008-12-26 09:50 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-26 09:50 --------- d-----w c:\program files\Java
2008-12-23 11:44 --------- d-----w c:\documents and settings\Patrik\Data aplikací\ICAClient
2008-12-21 08:54 --------- d--h--w c:\program files\Windows Media Connect 2
2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-19 12:20 20,480 ----a-w c:\windows\system32\ptevideo.dll
2008-12-06 15:33 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-06 15:33 167,936 ------w c:\windows\Setup1.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2007-01-05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= pdvcodec.dll
"VIDC.MSZH"= AVIMSZH.DLL
"vidc.ptev"= ptevideo.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\J:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:192.168.10.0/255.255.255.0:Enabled:Medisoft VNC

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-18 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-18 20560]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S4 602SQL 8 FastCGI Client;602SQL 8 FastCGI Client;c:\documents and settings\Patrik\Plocha\602FSVC8.EXE --> c:\documents and settings\Patrik\Plocha\602FSVC8.EXE [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4058f76-91e3-11dd-b738-0018f3aa49c1}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
Obsah adresáře 'Naplánované úlohy'

2009-02-18 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []

2009-02-19 c:\windows\Tasks\User_Feed_Synchronization-{278C1809-3925-4BD8-82AF-F201CC0784D6}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-PowerPoint Password Recovery - c:\program files\Intelore\PowerPoint Password Recovery\PowerPointPasswordRecovery.exe
HKLM-Run-Usbrun - d:\patrikovo\USBRun.exe
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
mStart Page = hxxp://www.microsoft.com
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 21:06:51
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-796845957-602162358-839522115-1008\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A8018DAA-0637-E8B5-08B1-85B70F007DD7}*]
"haknnbgapmphmhkj"=hex:69,61,68,6a,61,63,65,6f,6b,6f,6b,6a,6d,64,67,63,64,70,
00,00
"iaiplijlknfkobgncl"=hex:64,61,70,61,6c,65,6b,69,00,e0
"iaeolphfkageaklbdp"=hex:6b,61,68,6a,68,63,6e,61,6c,67,6d,66,65,64,6d,6e,6c,68,
6b,70,67,62,00,00
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-02-19 21:08:01
ComboFix-quarantined-files.txt 2009-02-19 20:07:59

Před spuštěním: Volných bajtů: 75,840,241,664
Po spuštění: Volných bajtů: 75,831,648,256

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

214 --- E O F --- 2009-02-11 13:20:03

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\drivers\AvgArCln.sys
c:\windows\system32\drivers\aswSP.sys
c:\windows\system32\drivers\aswFsBlk.sys

Driver::
AvgArCln
aswSP
aswFsBlk

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"=-


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
c:\documents and settings\Patrik\Plocha\602FSVC8.EXE
Vlož sem pak odkaz výsledku.
Restartuj comp a zkus nainstalovat znovu Avast.

[flashparkprd]

Zde je log z Combofixu:

ComboFix 09-02-19.01 - Patrik 2009-02-20 12:33:06.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1022.593 [GMT 1:00]
Spuštěný z: c:\documents and settings\Patrik\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Patrik\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090219-0] *On-access scanning enabled* (Updated)
* Vytvořen nový Bod Obnovení

FILE ::
c:\windows\system32\drivers\aswFsBlk.sys
c:\windows\system32\drivers\aswSP.sys
c:\windows\system32\drivers\AvgArCln.sys
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\aswFsBlk.sys
c:\windows\system32\drivers\aswSP.sys
c:\windows\system32\drivers\AvgArCln.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASWFSBLK
-------\Legacy_ASWSP
-------\Legacy_AVGARCLN
-------\Service_aswFsBlk
-------\Service_aswSP
-------\Service_AvgArCln


((((((((((((((((((((((((( Soubory vytvořené od 2009-01-20 do 2009-02-20 )))))))))))))))))))))))))))))))
.

2009-02-19 13:19 . 2009-02-19 13:23 <DIR> d-------- c:\program files\Intelore
2009-02-16 17:06 . 2009-02-16 17:06 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\fizzy
2009-02-15 15:57 . 2005-06-01 13:15 966,144 --a------ c:\windows\system32\AudioInfos.dll
2009-02-15 15:57 . 2006-11-18 13:38 200,704 --a------ c:\windows\system32\vbalExpBar6.ocx
2009-02-15 15:57 . 2005-01-10 14:54 116,296 --a------ c:\windows\system32\NCTWMAProfiles.prx
2009-02-15 11:49 . 2009-02-15 11:49 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\Malwarebytes
2009-02-15 11:49 . 2009-02-15 11:49 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2009-02-12 13:41 . 2008-04-14 03:09 566,784 --a------ c:\windows\system32\gpedit.dll
2009-02-12 13:41 . 2008-04-14 03:11 295,936 --a------ c:\windows\system32\appmgr.dll
2009-02-12 13:41 . 2008-04-14 03:11 199,680 --a------ c:\windows\system32\gptext.dll
2009-02-12 13:41 . 2008-04-14 03:11 167,936 --a------ c:\windows\system32\appmgmts.dll
2009-02-12 13:41 . 2008-04-14 03:11 124,928 --a------ c:\windows\system32\fde.dll
2009-02-12 13:41 . 2008-04-14 03:11 73,728 --a------ c:\windows\system32\fdeploy.dll
2009-02-12 13:41 . 2001-08-23 14:00 34,871 --a------ c:\windows\system32\gpedit.msc
2009-02-10 17:58 . 2009-02-10 17:58 <DIR> d-------- c:\documents and settings\Patrik\WINDOWS
2009-02-07 21:01 . 2009-02-07 21:01 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Ulead Systems
2009-02-07 20:47 . 2009-02-07 20:47 10 --a------ c:\windows\WININIT.INI
2009-02-07 19:44 . 2009-02-07 19:48 <DIR> d-------- c:\program files\The KMPlayer
2009-02-03 21:26 . 2009-02-03 21:26 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-03 21:26 . 2009-02-03 21:26 1,409 --a------ c:\windows\QTFont.for
2009-02-03 16:42 . 2009-02-03 16:42 <DIR> d-------- c:\windows\Lang
2009-02-02 20:26 . 2009-02-02 20:26 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\vsosdk
2009-02-02 19:48 . 2009-02-02 20:39 <DIR> d-------- c:\program files\DVDFab 5
2009-02-02 19:48 . 2009-02-02 19:48 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\Vso
2009-02-02 19:48 . 2009-02-02 19:48 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2009-02-02 19:48 . 2009-02-02 19:48 47,360 --a------ c:\documents and settings\Patrik\Data aplikací\pcouffin.sys
2009-02-01 20:59 . 2009-02-01 20:59 <DIR> d-------- c:\documents and settings\Patrik\Data aplikací\Obsidium
2009-02-01 20:58 . 2009-02-01 21:02 <DIR> d-------- c:\program files\Oront Burning Kit 2
2009-01-30 22:44 . 2009-01-30 22:45 70 --a------ c:\windows\hdkctnts.ini
2009-01-30 22:02 . 2009-02-20 12:31 517 --a------ c:\windows\ccleaner.ini
2009-01-29 21:48 . 2009-01-29 21:48 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\WEBREG
2009-01-29 21:46 . 2009-01-29 21:46 <DIR> d-------- c:\program files\Common Files\HP
2009-01-29 21:46 . 2009-01-29 21:46 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\HP
2009-01-29 21:45 . 2009-01-29 21:45 <DIR> d-------- c:\program files\Hewlett-Packard
2009-01-29 21:45 . 2009-01-29 21:45 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard
2009-01-29 21:45 . 2007-03-06 13:20 49,920 -ra------ c:\windows\system32\drivers\HPZid412.sys
2009-01-29 21:45 . 2007-03-06 13:20 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys
2009-01-29 21:44 . 2009-01-29 21:44 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Hewlett-Packard
2009-01-29 21:44 . 2007-03-15 15:39 958,464 -ra------ c:\windows\system32\hpotiop4.dll
2009-01-29 21:44 . 2007-03-15 15:39 675,840 -ra------ c:\windows\system32\hpowiax4.dll
2009-01-29 21:44 . 2007-03-06 13:20 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2009-01-29 21:44 . 2007-03-06 13:20 309,760 -ra------ c:\windows\system32\difxapi.dll
2009-01-29 21:44 . 2007-03-15 15:39 303,104 -ra------ c:\windows\system32\hpovst11.dll
2009-01-29 21:44 . 2007-03-29 00:29 267,864 -ra------ c:\windows\system32\hpzids01.dll
2009-01-29 21:44 . 2007-03-28 14:01 118,272 --a------ c:\windows\system32\hpz3l5ha.dll
2009-01-29 21:44 . 2007-03-06 13:20 21,568 -ra------ c:\windows\system32\drivers\HPZius12.sys
2009-01-29 21:44 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-01-29 21:44 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2009-01-29 21:41 . 2009-01-29 21:41 <DIR> d-------- c:\program files\HP
2009-01-29 21:38 . 2009-02-18 18:20 158,260 --a------ c:\windows\hpoins15.dat
2009-01-29 21:38 . 2007-12-12 21:02 1,039 --------- c:\windows\hpomdl15.dat
2009-01-29 21:20 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-29 21:20 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2009-01-28 22:16 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-01-28 22:11 . 2009-02-15 18:22 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-28 22:11 . 2009-01-28 22:11 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-28 22:11 . 2009-01-28 22:11 <DIR> d-------- c:\program files\MSBuild
2009-01-28 22:10 . 2009-01-28 22:53 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-28 22:10 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-01-28 22:10 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-01-28 22:10 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-01-28 22:10 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-01-28 22:10 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-28 22:10 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-01-28 22:10 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-26 18:28 . 2009-01-26 18:28 121 --a------ c:\windows\Winchat.ini
2009-01-22 13:05 . 2004-06-06 22:42 45,952 --a------ c:\windows\system32\drivers\filedisk.sys
2009-01-20 17:00 . 2009-01-20 17:00 1,451,248 --a------ c:\windows\Cleaner.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-15 15:02 --------- d-----w c:\program files\Free Easy Burner
2009-02-12 12:06 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Data aplikací\TEMP
2009-02-07 20:08 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 20:00 --------- d-----w c:\program files\Kobra 11 Nitro
2009-01-31 08:43 --------- d-----w c:\program files\ATI Technologies
2009-01-30 20:46 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Spybot - Search & Destroy
2009-01-18 12:11 3,888 ----a-w c:\windows\system32\drivers\NTHANDLE.SYS
2009-01-18 10:19 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\2BrightSparks
2009-01-17 17:06 --------- d-----w c:\documents and settings\Patrik\Data aplikací\ConvertTemp
2009-01-16 17:49 --------- d-----w c:\program files\Databaze_DVD_filmu
2009-01-16 13:43 --------- d-----w c:\program files\Common Files\Logitech
2009-01-15 17:25 --------- d-----w c:\program files\Common Files\Soft602
2009-01-13 15:31 796,672 ----a-w c:\windows\GPInstall.exe
2009-01-12 15:00 --------- d-----w c:\program files\Microsoft.NET
2009-01-10 22:28 --------- d-----w c:\documents and settings\Patrik\Data aplikací\Windows Search
2009-01-10 22:05 --------- d-----w c:\documents and settings\Táta\Data aplikací\Windows Desktop Search
2009-01-10 22:03 --------- d-----w c:\program files\Windows Desktop Search
2009-01-10 22:03 --------- d-----w c:\documents and settings\Patrik\Data aplikací\Windows Desktop Search
2009-01-10 14:09 --------- d-----w c:\documents and settings\Patrik\Data aplikací\Console
2009-01-05 15:09 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Trymedia
2009-01-04 12:08 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Alternate
2009-01-03 22:14 94 --sh--w c:\program files\desktop.ini
2009-01-02 22:16 --------- d-----w c:\program files\Servant Salamander 2.0
2008-12-26 09:50 --------- d-----w c:\program files\Java
2008-12-23 11:44 --------- d-----w c:\documents and settings\Patrik\Data aplikací\ICAClient
2008-12-21 08:54 --------- d--h--w c:\program files\Windows Media Connect 2
2008-12-06 15:33 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-06 15:33 167,936 ------w c:\windows\Setup1.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2007-01-05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= pdvcodec.dll
"VIDC.MSZH"= AVIMSZH.DLL
"vidc.ptev"= ptevideo.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\J:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:192.168.10.0/255.255.255.0:Enabled:Medisoft VNC

R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S4 602SQL 8 FastCGI Client;602SQL 8 FastCGI Client;c:\documents and settings\Patrik\Plocha\602FSVC8.EXE --> c:\documents and settings\Patrik\Plocha\602FSVC8.EXE [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d2d2063-d683-11dd-b7f1-0018f3aa49c1}]
\Shell\AutoRun\command - Sprezentace1.ppt

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4058f76-91e3-11dd-b738-0018f3aa49c1}]
\Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
Obsah adresáře 'Naplánované úlohy'

2009-02-18 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []

2009-02-20 c:\windows\Tasks\User_Feed_Synchronization-{278C1809-3925-4BD8-82AF-F201CC0784D6}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
mStart Page = hxxp://www.microsoft.com
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-20 12:36:04
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-796845957-602162358-839522115-1008\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A8018DAA-0637-E8B5-08B1-85B70F007DD7}*]
"haknnbgapmphmhkj"=hex:69,61,68,6a,61,63,65,6f,6b,6f,6b,6a,6d,64,67,63,64,70,
00,00
"iaiplijlknfkobgncl"=hex:64,61,70,61,6c,65,6b,69,00,e0
"iaeolphfkageaklbdp"=hex:6b,61,68,6a,68,63,6e,61,6c,67,6d,66,65,64,6d,6e,6c,68,
6b,70,67,62,00,00
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(628)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\searchindexer.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Celkový čas: 2009-02-20 12:38:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-02-20 11:38:01

Před spuštěním: Volných bajtů: 76 761 399 296
Po spuštění: Volných bajtů: 76,707,074,048

223 --- E O F --- 2009-02-11 13:20:03

--------------------------------------------------------------------------------------------------------------------------------------

Zde je log z HJT:

Logfile of HijackThis v2.0.2
Scan saved at 12:59:11, on 20.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Servant Salamander 2.0\salamand.exe
C:\WINDOWS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

-----------------------------------------------------------------------------------------------------------------------------------------

c:\documents and settings\Patrik\Plocha\602FSVC8.EXE
Jsem nenašel !!

Jinak jak koukám log je stejný jako předtím. A mě ani nepřijde že by bylo z avastem něco v nepořádku. MailScaner atd. nepoužívám. Používám jen rezidentní ochranu a testuji PC.

[jaro3]

Najdi a smaž: c:\windows\SxsCaPendDel
Odstraň z naplánovaných úloh:
c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
Vše.

[flashparkprd]

Tak jsem provedl vše co jste mi napsal. Jinak už je nejspíš všechno v pohodě.
Děkuji Vám za pomoc a za váš čas.

[jaro3]

Nemáš zač!!