Kontrola LOGU please

[leroyx]

Logfile of HijackThis v1.99.1
Scan saved at 13:45:48, on 26.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Bin\S24EvMon.exe
E:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Ansys Inc\Shared Files\Licensing\intel\Lmgrd.exe
E:\Program Files\Ansys Inc\Shared Files\Licensing\intel\lmgrd.exe
D:\Programy\AVG8\avgwdsvc.exe
D:\Programy\CatiaP3 V5R17\intel_a\code\bin\CATSysDemon.exe
E:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Intel\Bin\EvtEng.exe
D:\Programy\AVG8\avgrsx.exe
D:\Programy\AVG8\avgnsx.exe
E:\Program Files\Ansys Inc\Shared Files\Licensing\intel\ansyslmd.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\Programy\AVG8\avgcsrvx.exe
C:\Program Files\Adams2005r2\Licence\lmgrd.exe
C:\Program Files\Intel\Bin\RegSrvc.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
D:\Programy\AVG8\avgtray.exe
E:\WINDOWS\system32\ctfmon.exe
E:\WINDOWS\explorer.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\system32\taskmgr.exe
D:\Programy\Mozilla Firefox\firefox.exe
E:\Documents and Settings\lukinek\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.games-fusion.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - E:\WINDOWS\WebIE.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Programy\AVG8\avgssie.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - E:\WINDOWS\WebIE.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [AVG8_TRAY] D:\Programy\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer2\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer2\Add_AllO.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://E:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://J:\Programy\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést do Adobe PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést do existujícího PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést vybrané vazby do Adobe PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést vybrané vazby do existujícího PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést výběr do Adobe PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést výběr do existujícího PDF - res://D:\Programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - E:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - E:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - E:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - E:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - E:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - E:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - E:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - E:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programy\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programy\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2246170984
O17 - HKLM\System\CCS\Services\Tcpip\..\{449D9AF9-C046-4FCE-964C-20175BF8B20C}: NameServer = 213.155.229.197
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Programy\AVG8\avgpp.dll
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - D:\Programy\Inventor Professional 10\Bin\HSPCLPRO10.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - E:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: klogon - E:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANSYS FLEXlm license manager - Macrovision Corporation - E:\Program Files\Ansys Inc\Shared Files\Licensing\intel\Lmgrd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\Programy\AVG8\avgwdsvc.exe
O23 - Service: Backbone Service (BBDemon) - Unknown owner - D:\Programy\CatiaP3 V5R17\intel_a\code\bin\CATSysDemon.exe" -service (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - E:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - E:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Bin\EvtEng.exe
O23 - Service: Ansys JobManager Service V11 (JobManagerService110) - Ansys, Inc - C:\Program Files\Ansys11\v110\RSM\bin\JobManagerService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MSC.Licensing 9.2a - Macrovision Corporation - C:\Program Files\Adams2005r2\Licence\lmgrd.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Bin\S24EvMon.exe
O23 - Service: Ansys ScriptHost Service V11 (ScriptHostService110) - Ansys, Inc. - C:\Program Files\Ansys11\v110\RSM\bin\ScriptHostService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - E:\WINDOWS\system32\dllhost.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Reklama]

[jaro3]

Příště novější verzi HJT (2.02.):
http://www.trendsecure.com/portal/en-US ... s/download

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[leroyx]

Malwarebytes' Anti-Malware 1.34
Verze databáze: 1900
Windows 5.1.2600 Service Pack 3

26.3.2009 19:48:32
mbam-log-2009-03-26 (19-48-29).txt

Typ skenu: Rychlý sken
Objektu skenováno: 95323
Uplynulý cas: 8 minute(s), 6 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 3
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

[leroyx]

Jenze spis me stve ten jL.chura.pl

Microsoft Windows XP [Verze 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

E:\Documents and Settings\lukinek>netstat -a

Aktivnˇ pýipojenˇ

Proto Mˇstnˇ adresa Cizˇ adresa Stav
TCP LUKINEK:smtp LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:http LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:epmap LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:https LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:microsoft-ds LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:1031 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:1055 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:1259 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:1700 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:3260 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:3261 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:catiav5bb LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:1047 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:1055 jL.chura.pl:1261 NAVµZµNO
TCP LUKINEK:1261 jL.chura.pl:1055 NAVµZµNO
TCP LUKINEK:1895 jL.chura.pl:1896 NAVµZµNO
TCP LUKINEK:1896 jL.chura.pl:1895 NAVµZµNO
TCP LUKINEK:1897 jL.chura.pl:1898 NAVµZµNO
TCP LUKINEK:1898 jL.chura.pl:1897 NAVµZµNO
TCP LUKINEK:1906 jL.chura.pl:10080 CLOSE_WAIT
TCP LUKINEK:2165 jL.chura.pl:10080 TIME_WAIT
TCP LUKINEK:10080 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:10080 jL.chura.pl:2140 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2142 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2144 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2150 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2152 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2154 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2157 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2162 TIME_WAIT
TCP LUKINEK:10080 jL.chura.pl:2164 TIME_WAIT
TCP LUKINEK:13128 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:18080 LUKINEK:0 NASLOUCHµNÖ
TCP LUKINEK:2143 194.192.199.202:http LAST_ACK
TCP LUKINEK:2153 209.85.227.165:http LAST_ACK
TCP LUKINEK:2163 d125.server4u.cz:http LAST_ACK
TCP LUKINEK:epmap LUKINEK:0 NASLOUCHµNÖ 0
TCP LUKINEK:1031 LUKINEK:0 NASLOUCHµNÖ 0
UDP LUKINEK:microsoft-ds *:*
UDP LUKINEK:isakmp *:*
UDP LUKINEK:3456 *:*
UDP LUKINEK:4500 *:*
UDP LUKINEK:ntp *:*
UDP LUKINEK:ntp *:*

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM..

Vypni rez. ochranu u AVG+deaktivuj ZA.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Zítra tady nejsem , až v sobotu...

[leroyx]

ComboFix 09-03-25.04 - lukinek 2009-03-26 20:50:19.5 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1022.477 [GMT 1:00]
Spuštěný z: e:\documents and settings\lukinek\Plocha\ComboFix.exe
AV: Active Virus Shield *On-access scanning disabled* (Outdated)
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: Outpost Firewall Pro *disabled*
FW: ZoneAlarm Firewall *disabled*
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-02-26 do 2009-03-26 )))))))))))))))))))))))))))))))
.

2009-03-26 17:26 . 2009-03-26 17:26 603,904 --a------ e:\windows\system32\TUProgSt.exe
2009-03-26 17:26 . 2009-03-26 17:26 360,192 --a------ e:\windows\system32\TuneUpDefragService.exe
2009-03-26 17:26 . 2008-12-11 13:31 27,904 --a------ e:\windows\system32\uxtuneup.dll
2009-03-26 17:25 . 2009-03-26 17:28 <DIR> d-------- e:\program files\TuneUp Utilities 2009
2009-03-26 17:25 . 2009-03-26 17:25 <DIR> d-------- e:\documents and settings\All Users\Data aplikací\TuneUp Software
2009-03-26 17:10 . 2009-03-26 17:10 <DIR> d--hs---- e:\documents and settings\All Users\Data aplikací\{55A29068-F2CE-456C-9148-C869879E2357}
2009-03-26 16:51 . 2009-03-26 19:50 <DIR> d-------- e:\program files\AskBarDis
2009-03-26 12:56 . 2009-03-26 12:56 <DIR> d-------- e:\documents and settings\lukinek\Data aplikací\Malwarebytes
2009-03-26 12:56 . 2009-03-26 12:56 <DIR> d-------- e:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-26 12:56 . 2009-02-11 10:19 38,496 --a------ e:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 12:56 . 2009-02-11 10:19 15,504 --a------ e:\windows\system32\drivers\mbam.sys
2009-03-25 22:36 . 2009-03-25 22:36 <DIR> d-------- e:\documents and settings\All Users\Data aplikací\Adobe Systems
2009-03-19 01:34 . 2009-03-19 03:02 <DIR> d-------- e:\documents and settings\lukinek\Data aplikací\Dev-Cpp
2009-03-16 17:16 . 2009-03-16 17:30 <DIR> d-------- E:\ftp
2009-03-13 17:36 . 2009-03-13 17:36 0 --a------ e:\windows\system32\39.tmp
2009-03-13 17:35 . 2009-03-13 17:35 61,952 --a------ e:\windows\WCSMON.EXE
2009-03-13 17:34 . 2009-03-13 17:35 61,952 --a------ e:\windows\system32\30.tmp
2009-03-13 17:34 . 2009-03-13 17:34 128 --a------ e:\windows\system32\2F.tmp
2009-03-13 01:11 . 2009-01-18 22:35 15,688 --a------ e:\windows\system32\lsdelete.exe
2009-03-13 01:09 . 2009-03-13 01:09 0 --a------ e:\windows\system32\66.tmp
2009-03-13 01:05 . 2009-03-13 01:05 0 --a------ e:\windows\system32\64.tmp
2009-03-13 01:00 . 2009-03-13 01:00 0 --a------ e:\windows\system32\61.tmp
2009-03-13 00:58 . 2009-03-13 00:58 0 --a------ e:\windows\system32\5F.tmp
2009-03-13 00:32 . 2009-03-13 00:32 <DIR> d-------- e:\documents and settings\LocalService\Plocha
2009-03-13 00:20 . 2009-03-13 00:20 0 --a------ e:\windows\system32\5D.tmp
2009-03-13 00:19 . 2009-03-26 03:54 64,160 --a------ e:\windows\system32\drivers\Lbd.sys
2009-03-13 00:18 . 2009-03-13 00:18 <DIR> d-------- e:\program files\Lavasoft
2009-03-13 00:18 . 2009-03-13 00:18 <DIR> d--h-c--- e:\documents and settings\All Users\Data aplikací\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 23:57 . 2009-03-12 23:58 124 --a------ e:\windows\system32\23.tmp
2009-03-12 22:49 . 2009-02-16 00:10 1,221,512 --a------ e:\windows\system32\zpeng25.dll
2009-03-12 22:31 . 2009-03-12 22:31 124 --a------ e:\windows\system32\1C.tmp
2009-03-12 22:17 . 2009-03-12 22:17 <DIR> d-------- e:\program files\ZoneAlarmSB
2009-03-12 22:14 . 2009-03-12 22:14 <DIR> d-------- e:\documents and settings\All Users\Data aplikací\MailFrontier
2009-03-12 22:14 . 2009-03-26 16:50 4,212 --ah----- e:\windows\system32\zllictbl.dat
2009-03-12 22:13 . 2008-07-09 09:05 75,248 --a------ e:\windows\zllsputility.exe
2009-03-12 22:13 . 2004-04-27 04:40 11,264 --a------ e:\windows\system32\SpOrder.dll
2009-03-12 22:12 . 2009-03-26 16:53 <DIR> d-------- e:\windows\system32\ZoneLabs
2009-03-12 22:12 . 2009-03-26 18:40 350,192 --a------ e:\windows\system32\vsconfig.xml
2009-03-12 22:11 . 2009-03-26 20:42 <DIR> d-------- e:\windows\Internet Logs
2009-03-12 22:08 . 2009-03-12 22:08 124 --a------ e:\windows\system32\18.tmp
2009-03-12 21:56 . 2009-03-12 21:56 124 --a------ e:\windows\system32\55.tmp
2009-03-12 21:38 . 2009-03-13 00:18 <DIR> d-------- e:\documents and settings\All Users\Data aplikací\Lavasoft
2009-03-12 20:53 . 2009-03-12 20:53 124 --a------ e:\windows\system32\14.tmp
2009-03-12 20:07 . 2009-03-26 06:43 <DIR> d-------- E:\!KillBox
2009-03-12 20:04 . 2009-03-12 20:04 124 --a------ e:\windows\system32\2B.tmp
2009-03-12 19:58 . 2009-03-12 19:58 124 --a------ e:\windows\system32\20.tmp
2009-03-12 19:46 . 2009-03-12 19:46 124 --a------ e:\windows\system32\17.tmp
2009-03-12 19:31 . 2009-03-12 19:31 124 --a------ e:\windows\system32\11.tmp
2009-03-12 18:46 . 2009-03-12 18:46 192 --a------ e:\windows\system32\35.tmp
2009-03-12 18:46 . 2009-03-12 18:46 0 --a------ e:\windows\system32\36.tmp
2009-03-12 18:22 . 2009-03-12 18:22 124 --a------ e:\windows\system32\2A.tmp
2009-03-12 18:00 . 2009-03-12 18:00 124 --a------ e:\windows\system32\1D.tmp
2009-03-12 01:04 . 2009-03-12 18:19 <DIR> d-------- e:\documents and settings\lukinek\.msca
2009-03-12 01:01 . 2009-03-12 01:01 <DIR> d-------- e:\windows\2005r2
2009-03-12 01:01 . 2009-03-12 01:01 111 --------- e:\windows\achassis05r2.bat
2009-03-12 01:01 . 2009-03-12 01:01 104 --------- e:\windows\appt05r2.bat
2009-03-12 01:01 . 2009-03-12 01:01 92 --------- e:\windows\adams05r2.bat
2009-03-11 23:53 . 2009-03-12 19:46 8,192 --ahs---- e:\windows\system32\Thumbs.db
2009-03-11 23:53 . 2009-03-11 23:53 124 --a------ e:\windows\system32\32.tmp
2009-03-11 23:52 . 2009-03-26 19:05 41,984 --ahs---- e:\windows\Thumbs.db
2009-03-11 23:50 . 2009-03-11 23:50 124 --a------ e:\windows\system32\27.tmp
2009-03-10 20:17 . 2009-03-12 23:41 130 --a------ e:\windows\adobe.bat
2009-03-10 20:17 . 2009-03-10 20:19 6 --a------ e:\windows\_id.dat
2009-03-09 21:33 . 2009-03-09 21:33 <DIR> d-------- e:\program files\Common Files\ABBYY
2009-03-09 21:28 . 2009-01-01 22:12 <DIR> d-------- e:\documents and settings\All Users\Data aplikací\ABBYY

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 18:50 --------- d-----w e:\program files\Windows Media Connect 2
2009-03-26 18:50 --------- d-----w e:\program files\Piškvorky
2009-03-26 18:50 --------- d-----w e:\program files\ICQ6Toolbar
2009-03-26 18:50 --------- d-----w e:\program files\hp deskjet 3420 series
2009-03-26 18:12 --------- d-----w e:\documents and settings\lukinek\Data aplikací\Skype
2009-03-26 02:26 112,878 ----a-w e:\windows\Internet Logs\vsmon_2nd_2009_03_26_03_21_12_small.dmp.zip
2009-03-26 02:26 112,859 ----a-w e:\windows\Internet Logs\vsmon_2nd_2009_03_26_03_21_11_small.dmp.zip
2009-03-26 02:21 646,656 ----a-w e:\windows\Internet Logs\xDB4.tmp
2009-03-26 00:50 --------- d-----w e:\documents and settings\lukinek\Data aplikací\LimeWire
2009-03-25 21:39 --------- d-----w e:\program files\Common Files\Adobe
2009-03-18 20:49 --------- d-----w e:\program files\Microsoft SQL Server
2009-03-13 18:16 849,408 ----a-w e:\windows\Internet Logs\xDB1.tmp
2009-03-12 00:08 --------- d--h--w e:\program files\InstallShield Installation Information
2009-03-11 23:47 --------- d-----w e:\documents and settings\All Users\Data aplikací\avg8
2009-03-02 16:19 --------- d-----w e:\program files\Microsoft Silverlight
2009-02-24 22:12 --------- d-----w e:\documents and settings\lukinek\Data aplikací\Autodesk
2009-02-24 22:08 --------- d-----w e:\program files\Autodesk Test
2009-02-24 21:15 --------- d-----w e:\program files\Microsoft.NET
2009-02-24 19:32 --------- d-----w e:\program files\Common Files\Autodesk
2009-02-24 19:02 --------- d-----w e:\documents and settings\All Users\Data aplikací\Autodesk
2009-02-24 19:01 --------- d-----w e:\documents and settings\lukinek\Data aplikací\Ansys
2009-02-24 18:35 --------- d-----w e:\program files\Common Files\Autodesk Shared
2009-02-24 18:10 --------- d-----w e:\program files\AOEMView 2008
2009-02-24 18:08 --------- d-----w e:\program files\Microsoft WSE
2009-02-24 18:01 --------- d-----w e:\program files\DWG TrueView 2007
2009-02-24 18:01 --------- d-----w e:\program files\Autodesk
2009-02-21 13:25 325,128 ----a-w e:\windows\system32\drivers\avgldx86.sys
2009-02-21 13:25 107,272 ----a-w e:\windows\system32\drivers\avgtdix.sys
2009-02-21 13:25 10,520 ----a-w e:\windows\system32\avgrsstx.dll
2009-02-21 13:24 --------- d-----w e:\program files\AVG
2009-02-20 18:10 --------- d-----w e:\program files\Bridge Building Game
2009-02-20 17:44 --------- d---a-w e:\documents and settings\All Users\Data aplikací\TEMP
2009-02-20 17:23 --------- d-----w e:\documents and settings\All Users\Data aplikací\Intel
2009-02-20 16:55 --------- d-----w e:\documents and settings\All Users\Data aplikací\IsolatedStorage
2009-02-20 16:54 --------- d-----w e:\documents and settings\All Users\Data aplikací\Macrovision
2009-02-18 19:06 --------- d-----w e:\documents and settings\lukinek\Data aplikací\SolidWorks
2009-02-10 17:20 --------- d-----w e:\documents and settings\lukinek\Data aplikací\PTC
2009-02-10 17:17 --------- d-----w e:\program files\Java
2009-02-09 14:07 1,846,784 ----a-w e:\windows\system32\win32k.sys
2009-01-26 16:08 --------- d-----w e:\documents and settings\lukinek\Data aplikací\ImgBurn
2009-01-26 16:03 --------- d-----w e:\program files\ImgBurn
2009-01-07 14:07 139,576 ----a-w e:\documents and settings\lukinek\Data aplikací\GDIPFONTCACHEV1.DAT
2009-01-05 22:33 3,751,995 ----a-w e:\windows\system32\GPhotos.scr
2007-11-22 08:55 22,328 ----a-w e:\documents and settings\lukinek\Data aplikací\PnkBstrK.sys
.

------- Sigcheck -------

2008-04-14 04:22 1034241 18c91594ae4d1744fd043adfed3e4cd7 e:\windows\explorer.exe
2008-04-14 04:22 1034304 1be205d46f0b34a842da42722c34783a e:\windows\ServicePackFiles\i386\explorer.exe

2008-04-14 04:22 31472 8dd332c6198e75db7d1e14651e1fd301 e:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 04:22 15378 2b8f6283dfcbe0db29dcd3f2178854da e:\windows\system32\ctfmon.exe

2008-04-14 04:22 26112 219bf1518fd06adcaa9354f1aef67870 e:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 04:22 26112 555adc19a54c709d49e26091dde67341 e:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((( SnapShot_2009-03-26_ 3.42.45,61 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-12 23:21:38 16,384 ----a-w e:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-03-26 02:55:00 16,384 ----a-w e:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-12 23:21:38 32,768 ----a-w e:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-03-26 02:55:00 32,768 ----a-w e:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-03-12 23:21:38 32,768 ----a-w e:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-26 02:55:00 32,768 ----a-w e:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-26 02:54:42 64,160 -c--a-w e:\windows\system32\DRVSTORE\lbd_1D149FE61E2CD0936E43877117FE3EF0674B9944\Lbd.sys
- 2009-03-26 02:13:14 227,009 ----a-w e:\windows\system32\inetsrv\MetaBase.bin
+ 2009-03-26 17:41:38 227,006 ----a-w e:\windows\system32\inetsrv\MetaBase.bin
- 2009-03-12 19:42:16 137,022 ----a-w e:\windows\system32\perfc005.dat
+ 2009-03-26 16:47:59 137,022 ----a-w e:\windows\system32\perfc005.dat
- 2009-03-12 19:42:16 124,106 ----a-w e:\windows\system32\perfc009.dat
+ 2009-03-26 16:47:59 124,106 ----a-w e:\windows\system32\perfc009.dat
- 2009-03-12 19:42:16 557,176 ----a-w e:\windows\system32\perfh005.dat
+ 2009-03-26 16:47:59 557,176 ----a-w e:\windows\system32\perfh005.dat
- 2009-03-12 19:42:16 557,222 ----a-w e:\windows\system32\perfh009.dat
+ 2009-03-26 16:47:59 557,222 ----a-w e:\windows\system32\perfh009.dat
- 2008-11-13 14:18:44 107,408 ----a-w e:\windows\system32\vsdata.dll
+ 2009-02-15 23:10:10 110,472 ----a-w e:\windows\system32\vsdata.dll
- 2008-11-13 14:19:00 353,680 ----a-w e:\windows\system32\vsdatant.sys
+ 2009-02-15 23:10:26 353,672 ----a-w e:\windows\system32\vsdatant.sys
- 2008-11-13 14:18:44 216,464 ----a-w e:\windows\system32\vsinit.dll
+ 2009-02-15 23:10:10 229,256 ----a-w e:\windows\system32\vsinit.dll
- 2008-11-13 14:18:44 107,408 ----a-w e:\windows\system32\vsmonapi.dll
+ 2009-02-15 23:10:10 107,912 ----a-w e:\windows\system32\vsmonapi.dll
- 2008-11-13 14:18:44 310,160 ----a-w e:\windows\system32\vspubapi.dll
+ 2009-02-15 23:10:10 309,128 ----a-w e:\windows\system32\vspubapi.dll
- 2008-11-13 14:18:44 58,768 ----a-w e:\windows\system32\vsregexp.dll
+ 2009-02-15 23:10:10 58,248 ----a-w e:\windows\system32\vsregexp.dll
- 2008-11-13 14:18:46 475,536 ----a-w e:\windows\system32\vsutil.dll
+ 2009-02-15 23:10:10 482,184 ----a-w e:\windows\system32\vsutil.dll
- 2008-11-13 14:18:46 30,096 ----a-w e:\windows\system32\vswmi.dll
+ 2009-02-15 23:10:12 35,208 ----a-w e:\windows\system32\vswmi.dll
- 2008-11-13 14:18:46 110,480 ----a-w e:\windows\system32\vsxml.dll
+ 2009-02-15 23:10:12 109,960 ----a-w e:\windows\system32\vsxml.dll
- 2008-11-13 14:18:46 69,008 ----a-w e:\windows\system32\zlcomm.dll
+ 2009-02-15 23:10:12 69,000 ----a-w e:\windows\system32\zlcomm.dll
- 2008-11-13 14:18:46 106,384 ----a-w e:\windows\system32\zlcommdb.dll
+ 2009-02-15 23:10:12 103,816 ----a-w e:\windows\system32\zlcommdb.dll
- 2008-11-13 14:18:40 76,176 ----a-w e:\windows\system32\ZoneLabs\camupd.dll
+ 2009-02-15 23:10:06 74,632 ----a-w e:\windows\system32\ZoneLabs\camupd.dll
- 2008-11-13 14:18:42 98,192 ----a-w e:\windows\system32\ZoneLabs\fbl.dll
+ 2009-02-15 23:10:06 98,184 ----a-w e:\windows\system32\ZoneLabs\fbl.dll
- 2008-11-13 14:18:42 38,288 ----a-w e:\windows\system32\ZoneLabs\featuremap.dll
+ 2009-02-15 23:10:06 38,280 ----a-w e:\windows\system32\ZoneLabs\featuremap.dll
- 2008-11-13 14:18:42 159,120 ----a-w e:\windows\system32\ZoneLabs\httpblocker.dll
+ 2009-02-15 23:10:08 159,112 ----a-w e:\windows\system32\ZoneLabs\httpblocker.dll
- 2008-05-19 13:59:00 525,792 ----a-w e:\windows\system32\ZoneLabs\icslta.dll
+ 2009-02-04 17:27:18 548,128 ----a-w e:\windows\system32\ZoneLabs\icslta.dll
- 2008-11-13 14:19:02 28,048 ----a-w e:\windows\system32\ZoneLabs\lib\Alert.zip.dll
+ 2009-02-15 23:10:28 35,720 ----a-w e:\windows\system32\ZoneLabs\lib\Alert.zip.dll
- 2008-11-13 14:19:02 322,960 ----a-w e:\windows\system32\ZoneLabs\lib\ConfigWizard.zip.dll
+ 2009-02-15 23:10:28 344,456 ----a-w e:\windows\system32\ZoneLabs\lib\ConfigWizard.zip.dll
- 2008-11-13 14:19:02 122,768 ----a-w e:\windows\system32\ZoneLabs\lib\DashBoard.zip.dll
+ 2009-02-15 23:10:28 136,584 ----a-w e:\windows\system32\ZoneLabs\lib\DashBoard.zip.dll
- 2008-11-13 14:19:02 331,664 ----a-w e:\windows\system32\ZoneLabs\lib\LicenseUI.zip.dll
+ 2009-02-15 23:10:28 344,968 ----a-w e:\windows\system32\ZoneLabs\lib\LicenseUI.zip.dll
- 2008-11-13 14:19:02 10,128 ----a-w e:\windows\system32\ZoneLabs\lib\MainLoop.zip.dll
+ 2009-02-15 23:10:30 12,168 ----a-w e:\windows\system32\ZoneLabs\lib\MainLoop.zip.dll
- 2008-11-13 14:19:04 18,320 ----a-w e:\windows\system32\ZoneLabs\lib\NavBar.zip.dll
+ 2009-02-15 23:10:30 29,576 ----a-w e:\windows\system32\ZoneLabs\lib\NavBar.zip.dll
+ 2009-02-15 23:10:30 11,144 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1010.zip.dll
+ 2009-02-15 23:10:30 11,656 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1413.zip.dll
+ 2009-02-15 23:10:30 13,704 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1440.zip.dll
+ 2009-02-15 23:10:30 10,632 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1445.zip.dll
+ 2009-02-15 23:10:30 10,120 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1454.zip.dll
+ 2009-02-15 23:10:30 9,608 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1460.zip.dll
+ 2009-02-15 23:10:30 17,800 ----a-w e:\windows\system32\ZoneLabs\lib\oem_1466.zip.dll
- 2008-11-13 14:19:04 110,992 ----a-w e:\windows\system32\ZoneLabs\lib\Overview.zip.dll
+ 2009-02-15 23:10:30 188,808 ----a-w e:\windows\system32\ZoneLabs\lib\Overview.zip.dll
- 2008-11-13 14:19:04 19,856 ----a-w e:\windows\system32\ZoneLabs\lib\UpdateUI.zip.dll
+ 2009-02-15 23:10:30 34,696 ----a-w e:\windows\system32\ZoneLabs\lib\UpdateUI.zip.dll
- 2008-11-13 14:19:04 43,920 ----a-w e:\windows\system32\ZoneLabs\lib\ZAlert.zip.dll
+ 2009-02-15 23:10:30 84,872 ----a-w e:\windows\system32\ZoneLabs\lib\ZAlert.zip.dll
- 2008-11-13 14:19:04 19,344 ----a-w e:\windows\system32\ZoneLabs\lib\zic.zip.dll
+ 2009-02-15 23:10:30 24,968 ----a-w e:\windows\system32\ZoneLabs\lib\zic.zip.dll
- 2008-11-13 14:19:04 13,712 ----a-w e:\windows\system32\ZoneLabs\lib\zmenu.zip.dll
+ 2009-02-15 23:10:30 14,216 ----a-w e:\windows\system32\ZoneLabs\lib\zmenu.zip.dll
- 2008-11-13 14:19:04 30,608 ----a-w e:\windows\system32\ZoneLabs\lib\zpdp.zip.dll
+ 2009-02-15 23:10:30 59,272 ----a-w e:\windows\system32\ZoneLabs\lib\zpdp.zip.dll
- 2008-11-13 14:19:04 1,536,400 ----a-w e:\windows\system32\ZoneLabs\lib\zpy.zip.dll
+ 2009-02-15 23:10:32 1,536,392 ----a-w e:\windows\system32\ZoneLabs\lib\zpy.zip.dll
- 2008-11-13 14:19:04 18,832 ----a-w e:\windows\system32\ZoneLabs\lib\zsys.zip.dll
+ 2009-02-15 23:10:32 20,360 ----a-w e:\windows\system32\ZoneLabs\lib\zsys.zip.dll
- 2008-11-13 14:19:04 70,032 ----a-w e:\windows\system32\ZoneLabs\lib\ztv.zip.dll
+ 2009-02-15 23:10:32 151,944 ----a-w e:\windows\system32\ZoneLabs\lib\ztv.zip.dll
- 2008-11-13 14:19:04 114,064 ----a-w e:\windows\system32\ZoneLabs\lib\zui.zip.dll
+ 2009-02-15 23:10:32 118,664 ----a-w e:\windows\system32\ZoneLabs\lib\zui.zip.dll
- 2008-11-13 14:19:06 59,792 ----a-w e:\windows\system32\ZoneLabs\lib\zvpn.zip.dll
+ 2009-02-15 23:10:32 94,088 ----a-w e:\windows\system32\ZoneLabs\lib\zvpn.zip.dll
- 2008-04-21 06:19:42 718,272 ----a-w e:\windows\system32\ZoneLabs\qrbase.dll
+ 2008-11-17 01:23:50 722,400 ----a-w e:\windows\system32\ZoneLabs\qrbase.dll
- 2008-04-21 06:19:44 792,000 ----a-w e:\windows\system32\ZoneLabs\qrsrecl.dll
+ 2008-11-17 01:23:52 796,128 ----a-w e:\windows\system32\ZoneLabs\qrsrecl.dll
- 2008-11-13 14:18:42 132,496 ----a-w e:\windows\system32\ZoneLabs\scheduler.dll
+ 2009-02-15 23:10:08 134,536 ----a-w e:\windows\system32\ZoneLabs\scheduler.dll
- 2008-04-21 06:19:46 8,790,493 ----a-w e:\windows\system32\ZoneLabs\spyware.dat
+ 2008-12-15 00:11:48 10,465,257 ----a-w e:\windows\system32\ZoneLabs\spyware.dat
- 2008-04-21 06:19:52 1,516,992 ----a-w e:\windows\system32\ZoneLabs\srescan.dll
+ 2008-11-17 01:23:54 1,512,928 ----a-w e:\windows\system32\ZoneLabs\srescan.dll
- 2008-04-21 06:19:58 51,648 ----a-w e:\windows\system32\ZoneLabs\srescan.sys
+ 2008-11-17 01:24:00 51,688 ----a-w e:\windows\system32\ZoneLabs\srescan.sys
- 2008-11-13 14:18:44 443,280 ----a-w e:\windows\system32\ZoneLabs\ssleay32.dll
+ 2009-02-15 23:10:08 431,496 ----a-w e:\windows\system32\ZoneLabs\ssleay32.dll
- 2008-11-13 14:18:54 176,016 ----a-w e:\windows\system32\ZoneLabs\updclient.exe
+ 2009-02-15 23:10:22 176,520 ----a-w e:\windows\system32\ZoneLabs\updclient.exe
- 2008-11-13 14:18:44 106,896 ----a-w e:\windows\system32\ZoneLabs\vsdb.dll
+ 2009-02-15 23:10:10 108,424 ----a-w e:\windows\system32\ZoneLabs\vsdb.dll
- 2008-11-13 14:18:56 2,405,776 ----a-w e:\windows\system32\ZoneLabs\vsmon.exe
+ 2009-02-15 23:10:22 2,402,184 ----a-w e:\windows\system32\ZoneLabs\vsmon.exe
- 2008-11-13 14:18:46 1,655,184 ----a-w e:\windows\system32\ZoneLabs\vsruledb.dll
+ 2009-02-15 23:10:10 1,648,520 ----a-w e:\windows\system32\ZoneLabs\vsruledb.dll
- 2008-11-13 14:18:46 172,432 ----a-w e:\windows\system32\ZoneLabs\vsvault.dll
+ 2009-02-15 23:10:12 172,936 ----a-w e:\windows\system32\ZoneLabs\vsvault.dll
- 2008-04-21 06:19:46 8,790,493 ----a-w e:\windows\system32\ZoneLabs\zlasdbup.dat
+ 2008-12-15 00:11:48 10,465,257 ----a-w e:\windows\system32\ZoneLabs\zlasdbup.dat
- 2008-11-13 14:18:46 178,576 ----a-w e:\windows\system32\ZoneLabs\zlparser.dll
+ 2009-02-15 23:10:12 178,568 ----a-w e:\windows\system32\ZoneLabs\zlparser.dll
- 2008-11-13 14:18:48 98,192 ----a-w e:\windows\system32\ZoneLabs\zlquarantine.dll
+ 2009-02-15 23:10:12 97,672 ----a-w e:\windows\system32\ZoneLabs\zlquarantine.dll
- 2008-11-13 14:18:48 311,696 ----a-w e:\windows\system32\ZoneLabs\zlsre.dll
+ 2009-02-15 23:10:12 302,472 ----a-w e:\windows\system32\ZoneLabs\zlsre.dll
- 2008-11-13 14:18:48 110,480 ----a-w e:\windows\system32\ZoneLabs\zlupdate.dll
+ 2009-02-15 23:10:14 108,424 ----a-w e:\windows\system32\ZoneLabs\zlupdate.dll
+ 2008-07-29 02:51:28 245,760 ----a-w e:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcm90.dll
+ 2008-07-29 04:23:12 856,576 ----a-w e:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcp90.dll
+ 2008-07-29 04:23:12 626,688 ----a-w e:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcr90.dll
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="e:\windows\system32\ctfmon.exe" [2008-04-14 15378]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="d:\programy\AVG8\avgtray.exe" [2009-02-21 1601304]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15378]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-21 14:25 10520 e:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Acrobat Speed Launcher.lnk]
backup=e:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=e:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=e:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Logitech SetPoint.lnk]
backup=e:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
backup=e:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^RAMASST.lnk]
backup=e:\windows\pss\RAMASST.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Service Manager.lnk]
backup=e:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^VersionTrackerPro.lnk]
backup=e:\windows\pss\VersionTrackerPro.lnkCommon Startup

[HKLM\~\startupfolder\E:^Documents and Settings^lukinek^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=e:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\E:^Documents and Settings^lukinek^Nabídka Start^Programy^Po spuštění^CZDC++ pro KN HuB.lnk]
backup=e:\windows\pss\CZDC++ pro KN HuB.lnkStartup

[HKLM\~\startupfolder\E:^Documents and Settings^lukinek^Nabídka Start^Programy^Po spuštění^Secunia PSI.lnk]
path=e:\documents and settings\lukinek\Nabídka Start\Programy\Po spuštění\Secunia PSI.lnk
backup=e:\windows\pss\Secunia PSI.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
e:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
--a------ 2004-12-14 11:12 483329 d:\programy\Acrobat7\Distillr\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
--a------ 2009-03-26 03:53 515416 e:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2005-06-06 22:46 57345 d:\programy\AdobeAlbum\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 d:\programy\Reader8\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-12-07 20:10 344067 e:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 04:22 15378 e:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2002-04-29 20:11 188461 e:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a------ 2007-10-08 14:18 995328 c:\program files\Intel\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
--a------ 2004-12-09 06:50 311301 e:\program files\Launch Manager\QtZgAcer.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155679 e:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NotebookHardwareControl]
--a------ 2007-05-04 01:33 2629633 c:\program files\Notebook Hardware Control\nhc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413699 e:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-11-07 14:31 21633320 e:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-10-11 15:58 1410296 c:\hry\Steam\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-11-09 15:07 49263 e:\program files\Java\jre1.5.0_10\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
--a--c--- 2007-05-23 00:00 56080 e:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a--c--- 2007-05-23 00:00 56080 e:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MSSQLServerADHelper"=3 (0x3)
"iPod Service"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"rpcapd"=3 (0x3)
"Remote Solver for COSMOSFloWorks 2006"=2 (0x2)
"Prime95 Service"=3 (0x3)
"MDM"=2 (0x2)
"IDriverT"=3 (0x3)
"DVD-RAM_Service"=2 (0x2)
"CLTNetCnService"=2 (0x2)
"AVP"=2 (0x2)
"Autodesk Licensing Service"=3 (0x3)
"Autodesk EDM Server"=3 (0x3)
"Autodesk Data Management Job Dispatch"=2 (0x2)
"anbmService"=3 (0x3)
"Adobe LM Service"=3 (0x3)
"aawservice"=2 (0x2)
"ICQ Service"=2 (0x2)
"gusvc"=3 (0x3)
"ABBYY.Licensing.FineReader.Professional.9.0"=2 (0x2)
"6to4"=2 (0x2)
"SQLWriter"=3 (0x3)
"MSSQL$AUTODESKVAULT"=2 (0x2)
"COMSysApp"=3 (0x3)
"Lavasoft Ad-Aware Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"AntiSpyWareDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"e:\windows\system32\sessmgr.exe"= e:\windows\system32\sessmgr.exe:192.168.90.4/255.255.255.255:Disabled:@xpsp2res.dll,-22019
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;e:\windows\system32\drivers\Lbd.sys [2009-03-13 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;e:\windows\system32\drivers\avgldx86.sys [2009-02-21 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;e:\windows\system32\drivers\avgtdix.sys [2009-02-21 107272]
R1 LUMDriver;LUMDriver;e:\windows\system32\drivers\LUMDriver.sys [2006-10-13 14912]
R2 ANSYS FLEXlm license manager;ANSYS FLEXlm license manager;e:\program files\Ansys Inc\Shared Files\Licensing\intel\lmgrd.exe [2008-09-27 1294336]
R2 avg8wd;AVG Free8 WatchDog;d:\programy\AVG8\avgwdsvc.exe [2009-02-21 298264]
R2 BBDemon;Backbone Service;d:\programy\CatiaP3 V5R17\intel_a\code\bin\CATSysDemon.exe [2006-04-29 49164]
R2 CbmDev1;CbmDev1;e:\windows\system32\drivers\cbmdev1.sys [2007-05-21 12704]
R2 CbmDev2;CbmDev2;e:\windows\system32\drivers\cbmdev2.sys [2007-05-21 12704]
R2 CbmDev3;CbmDev3;e:\windows\system32\drivers\cbmdev3.sys [2007-05-21 12704]
R2 EpmPsd;Acer EPM Power Scheme Driver;e:\windows\system32\drivers\epm-psd.sys [2006-11-13 4096]
R2 EpmShd;Acer EPM System Hardware Driver;e:\windows\system32\drivers\epm-shd.sys [2006-11-13 78208]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;e:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]
R2 MSC.Licensing 9.2a;MSC.Licensing 9.2a;c:\program files\Adams2005r2\Licence\lmgrd.exe [2009-03-12 659457]
R2 osaio;osaio;e:\windows\system32\drivers\osaio.sys [2004-09-20 10363]
R2 osanbm;osanbm;e:\windows\system32\drivers\osanbm.sys [2004-06-01 4054]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;e:\windows\system32\TUProgSt.exe [2009-03-26 603904]
R3 PSched;Plánovač paketů technologie QoS;e:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S2 JobManagerService110;Ansys JobManager Service V11;c:\program files\Ansys11\v110\RSM\bin\JobManagerService.exe [2007-01-16 20482]
S2 ScriptHostService110;Ansys ScriptHost Service V11;c:\program files\Ansys11\v110\RSM\bin\ScriptHostService.exe [2007-01-16 20481]
S3 commiwi;[CommView] Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows 2000;e:\windows\system32\drivers\commiwi.sys [2007-07-30 17:02:31 206336]
S3 cpuz128;cpuz128;c:\program files\PC Wizard 2008\pcwiz32.sys [2007-10-16 7808]
S3 nhcAcpi_driver;Notebook Hardware Control ACPI Driver;\??\e:\windows\system32\drivers\nhcAcpi.sys --> e:\windows\system32\drivers\nhcAcpi.sys [?]
S3 nhcNT_driver;Notebook Hardware Control NT Driver;\??\e:\windows\system32\drivers\nhcNT.sys --> e:\windows\system32\drivers\nhcNT.sys [?]
S3 NPF;NetGroup Packet Filter Driver;e:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 PEEK5;PEEK5 Protocol Driver;\??\e:\docume~1\lukinek\Plocha\WINAIR~1\WINAIR~1\PEEK5.SYS --> e:\docume~1\lukinek\Plocha\WINAIR~1\WINAIR~1\PEEK5.SYS [?]
S3 PSI;PSI;e:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
S3 RTLWUSB;802.11g USB2.0 WLAN Dongle;e:\windows\system32\DRIVERS\RTL8187.sys --> e:\windows\system32\DRIVERS\RTL8187.sys [?]
S3 SjyPkt;SjyPkt;\??\e:\windows\System32\Drivers\SjyPkt.sys --> e:\windows\System32\Drivers\SjyPkt.sys [?]
S3 TVICHW32;TVICHW32;e:\windows\system32\drivers\TVICHW32.SYS [2008-07-03 23600]
S4 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;e:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 660768]
S4 NetFxUpdate_v1.1.4322;Microsoft .NET Framework v1.1.4322 Update;e:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe [2007-01-15 73730]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{545a2154-8ba1-11db-afdd-000e35fa75c6}]
\Shell\AutoRun\command - G:\autorun6e.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4fdf34d-9185-11db-afe5-000e35fa75c6}]
\Shell\AutoRun\command - G:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0ecf382-8b9c-11db-afda-000e35fa75c6}]
\Shell\AutoRun\command - G:\autorun6e.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd050320-b5d1-11db-9bf9-000e35fa75c6}]
\Shell\AutoRun\command - WD_Windows_Tools\Setup.exe
.
Obsah adresáře 'Naplánované úlohy'

2009-03-26 e:\windows\Tasks\1-Click Maintenance.job
- e:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 21:36]

2009-03-26 e:\windows\Tasks\Ad-Aware Update (Weekly).job
- e:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-26 03:53]

2009-02-20 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-03-26 e:\windows\Tasks\User_Feed_Synchronization-{4F8B9B32-566C-4711-814E-33CE3E745FE8}.job
- e:\windows\system32\msfeedssync.exe [2008-08-22 02:05]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.games-fusion.net
uInternet Settings,ProxyServer = socks=
uInternet Settings,ProxyOverride = 127.0.0.1
IE: &ICQ Toolbar Search - d:\programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: + Offline &Explorer: Download the link - file://c:\program files\Offline Explorer2\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page - file://c:\program files\Offline Explorer2\Add_AllO.htm
IE: Add to Google Photos Screensa&ver - e:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - j:\programy\OFFICE~1\OFFICE11\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést cíl vazby do existujícího PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Převést do Adobe PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést do existujícího PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Převést vybrané vazby do Adobe PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést vybrané vazby do existujícího PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést výběr do Adobe PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést výběr do existujícího PDF - d:\programy\Acrobat7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - e:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - e:\windows\WebIE.dll
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: servis24.cz\www
Trusted Zone: windowsupdate.com
TCP: {449D9AF9-C046-4FCE-964C-20175BF8B20C} = 213.155.229.197
FF - ProfilePath - e:\documents and settings\lukinek\Data aplikací\Mozilla\Firefox\Profiles\lbzk3t2k.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.atlas.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: d:\programy\AVG8\Firefox\components\avgssff.dll
FF - plugin: d:\programy\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\programy\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programy\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: d:\programy\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: d:\programy\Picasa3\npPicasa3.dll
FF - plugin: d:\programy\Reader8\Reader\browser\nppdf32.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPJava11.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPJava12.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPJava13.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPJava14.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPJava32.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPJPI150_10.dll
FF - plugin: e:\program files\Java\jre1.5.0_10\bin\NPOJI610.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: content.switch.threshold - 600000
d:\programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-26 20:52:53
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(748)
e:\windows\system32\Ati2evxx.dll
e:\windows\system32\klogon.dll
.
Celkový čas: 2009-03-26 20:55:45
ComboFix-quarantined-files.txt 2009-03-26 19:55:28
ComboFix2.txt 2009-03-26 02:45:08
ComboFix3.txt 2009-03-13 17:18:56
ComboFix4.txt 2009-03-13 16:58:59

Před spuštěním: 2 429 415 424
Po spuštění: 2,445,037,568

Current=7 Default=7 Failed=3 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
515 --- E O F --- 2009-03-26 19:02:37

[jaro3]

Máš tam dva antiviry:
Active Virus
AVG Anti-Virus Free

a dva firewally:
Outpost Firewall Pro
ZoneAlarm Firewall
Od každého jeden odinstaluj.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Folder::
e:\program files\AskBarDis

File::
e:\windows\system32\39.tmp
e:\windows\WCSMON.EXE
e:\windows\system32\30.tmp
e:\windows\system32\2F.tmp
e:\windows\system32\66.tmp
e:\windows\system32\64.tmp
e:\windows\system32\61.tmp
e:\windows\system32\5F.tmp
e:\windows\system32\5D.tmp
e:\windows\system32\23.tmp
e:\windows\system32\1C.tmp
e:\windows\system32\18.tmp
e:\windows\system32\55.tmp
e:\windows\system32\14.tmp
e:\windows\system32\2B.tmp
e:\windows\system32\20.tmp
e:\windows\system32\17.tmp
e:\windows\system32\11.tmp
e:\windows\system32\35.tmp
e:\windows\system32\36.tmp
e:\windows\system32\2A.tmp
e:\windows\system32\1D.tmp
e:\windows\system32\32.tmp
e:\windows\system32\27.tmp
e:\windows\adobe.bat
e:\windows\_id.dat
e:\windows\Internet Logs\xDB4.tmp
e:\windows\Internet Logs\xDB1.tmp
G:\autorun6e.exe
G:\autoplay.exe

Registry::
HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"AntiSpyWareDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000000
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{545a2154-8ba1-11db-afdd-000e35fa75c6}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4fdf34d-9185-11db-afe5-000e35fa75c6}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0ecf382-8b9c-11db-afda-000e35fa75c6}]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
e:\documents and settings\lukinek\.msca
e:\windows\2005r2
e:\windows\achassis05r2.bat
e:\windows\appt05r2.bat
e:\windows\Internet Logs\vsmon_2nd_2009_03_26_03_21_12_small.dmp.zip
e:\windows\Internet Logs\vsmon_2nd_2009_03_26_03_21_11_small.dmp.zip
Vlož sem pak odkazy výsledků.