Prosím o kontrolu logu z HJT Vyřešeno

[miruska27]

Hezký večer. Prosím o kontrolu tohoto logu u HJT. Po spuštění se mi načítají ikony asi 3 minuty a je celý zpomalený. Díky moc za pomoc... M*

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59:39, on 30.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\VM305_STI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Documents and Settings\Mirek\Mirek.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN .exe
C:\WINDOWS\vsnpstd2 .exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\F-Secure\FSAUA\program\fsus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\Mirek\LOCALS~1\Temp\9409 .exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Mirek] C:\Documents and Settings\Mirek\Mirek.exe /i
O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\Mirek\LOCALS~1\Temp\9409 .exe
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 10316 bytes

[Reklama]

[miruska27]

Poradí mi někdo šikovný co je špatně?? Děkuji už teď... M*

[jaro3]

F-Secure by měla být komplexní ochrana , vypnul bych rez. štít u SpywareTerminatora-nebo ho celý odinstaloval...


vyčisti systém CCleanerem

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[miruska27]

Musel jsem odběhnout a mezitím mi syn léčil MBAM takže výsledek je tento:

Malwarebytes' Anti-Malware 1.35
Verze databáze: 1921
Windows 5.1.2600 Service Pack 3

30.3.2009 22:05:57
mbam-log-2009-03-30 (22-05-57).txt

Typ skenu: Rychlý sken
Objektu skenováno: 66013
Uplynulý cas: 2 minute(s), 1 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

Ale F-Secure mi stále hlásí že našel vir:Rootkit.Win32.Agent.Ikz a stále dokola se zpouští.

Odinstaloval jsem Spyware Terminator, Ale v HJT jsem nenašel pro fixnutí tyto soubory:O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O13 - Gopher Prefix:

Vyčištěno CC-Cleanerem a AFT Cleanem

[miruska27]

¸Vkládám pro jistotu nový log z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:30:49, on 30.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\FSAUA\program\fsus.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\VM305_STI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN .exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Mirek\Mirek.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Mirek] C:\Documents and Settings\Mirek\Mirek.exe /i
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9961 bytes

[jaro3]

Vypni rez. ochrany u F-Secure+firewall.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[miruska27]

Jaro vypnul jsem F-Secure stáhnul na plochu ComboFix. Když ho spustím,objeví se mi jen modré okno a v něm bliká kurzor. Dál to nic nedělá (

[jaro3]

Zkus ho spustit v nouzovém režimu, budu tady odpoledne.

[miruska27]

Dalo to práci,ale podařilo se... Tady je log u CF v nouzovém režimu.

ComboFix 09-03-30.02 - Mirek 2009-03-31 11:55:45.1 - NTFSx86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1806 [GMT 2:00]
Spuštěný z: c:\documents and settings\Mirek\Plocha\ComboFix.exe
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated)
FW: F-Secure Profi Antivirus 8.01 *disabled*

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-02-28 do 2009-03-31 )))))))))))))))))))))))))))))))
.

2009-03-30 21:00 . 2009-03-30 21:00 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-30 21:00 . 2009-03-30 21:00 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Malwarebytes
2009-03-30 21:00 . 2009-03-30 21:00 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-30 21:00 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-30 21:00 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-30 18:59 . 2009-03-30 18:59 <DIR> d-------- c:\program files\Trend Micro
2009-03-30 18:56 . 2009-03-31 11:49 23,052 --a------ c:\windows\vm305_sti.exe vimicro usb pc camera (zc0305)
2009-03-30 18:56 . 2009-03-30 18:56 23,052 --a------ c:\windows\vm305_sti .exe
2009-03-30 17:27 . 2009-03-30 17:27 <DIR> d-------- c:\windows\EffectResources
2009-03-30 17:27 . 2009-03-30 17:27 <DIR> d-------- c:\windows\CatRoot
2009-03-30 17:27 . 2009-03-30 17:27 <DIR> d-------- c:\program files\Vimicro
2009-03-30 17:27 . 2006-05-08 10:24 391,688 --a------ c:\windows\system32\drivers\usbVM305.sys
2009-03-30 17:27 . 2000-10-31 12:00 307,200 --a------ c:\windows\vidcap32.Exe
2009-03-30 17:27 . 2005-05-03 15:51 176,128 --a------ c:\windows\amcap.exe
2009-03-30 17:27 . 2005-11-08 11:37 155,722 --a------ c:\windows\system32\VM305Prp.Ax
2009-03-30 17:27 . 2005-08-08 16:36 114,688 --a------ c:\windows\VM305Cap.exe
2009-03-30 17:27 . 2005-08-05 18:36 81,920 --a------ c:\windows\system32\VM305STI.dll
2009-03-30 17:27 . 2005-08-05 15:15 61,440 --a------ c:\windows\VM305_STI.EXE
2009-03-30 17:27 . 2005-05-02 16:45 53,248 --a------ c:\windows\Sti305.exe
2009-03-29 22:48 . 2009-03-29 22:48 <DIR> d-------- C:\Phenomedia AG
2009-03-29 18:25 . 2009-03-29 20:34 0 --a------ c:\windows\XXLGSC
2009-03-29 18:18 . 2009-03-30 10:46 2,686 --a------ c:\windows\TRNCOM.INI
2009-03-29 18:15 . 2009-03-29 18:18 <DIR> d-------- C:\TRANSLAT
2009-03-29 18:15 . 2009-03-31 11:49 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\LangSoft
2009-03-29 18:11 . 2009-03-29 22:58 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\LangSoft
2009-03-29 12:34 . 2009-03-30 21:11 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\F-Secure
2009-03-29 12:32 . 2008-12-04 15:57 79,872 --a------ c:\windows\system32\drivers\fsdfw.sys
2009-03-29 12:32 . 2009-03-29 12:46 33,408 --a------ c:\windows\system32\drivers\fsbts.sys
2009-03-29 12:31 . 2009-03-31 11:04 <DIR> d-------- c:\program files\F-Secure
2009-03-29 12:26 . 2009-03-29 12:30 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\fssg
2009-03-29 12:25 . 2009-03-29 12:31 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\f-secure
2009-03-29 11:20 . 2009-03-29 11:20 <DIR> d--hs---- c:\documents and settings\NetworkService\PrivacIE
2009-03-29 11:20 . 2009-03-29 11:20 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache
2009-03-29 11:00 . 2009-03-29 11:00 <DIR> dr------- c:\documents and settings\NetworkService\Oblíbené položky
2009-03-29 00:22 . 2009-03-29 00:22 <DIR> d-------- c:\program files\VSO
2009-03-29 00:22 . 2006-05-20 17:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2009-03-29 00:22 . 2006-05-11 20:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2009-03-29 00:22 . 2006-09-29 13:24 217,127 --a------ c:\windows\system32\drv43260.dll
2009-03-29 00:22 . 2006-09-29 13:25 208,935 --a------ c:\windows\system32\drv33260.dll
2009-03-29 00:22 . 2006-09-29 13:26 176,165 --a------ c:\windows\system32\drv23260.dll
2009-03-29 00:22 . 2002-12-10 03:20 102,439 --a------ c:\windows\system32\sipr3260.dll
2009-03-29 00:22 . 2007-03-18 21:37 65,602 --a------ c:\windows\system32\cook3260.dll
2009-03-28 13:15 . 2009-03-28 13:15 <DIR> d-------- c:\windows\CtDrvInstall
2009-03-28 13:15 . 2009-03-28 13:15 <DIR> d-------- C:\Live! Cam
2009-03-27 22:55 . 2009-03-27 22:55 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\PC Drivers HeadQuarters
2009-03-27 22:52 . 2009-03-28 13:57 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\GetRightToGo
2009-03-27 19:53 . 2009-03-27 19:53 <DIR> d-------- c:\documents and settings\LocalService\Bluetooth Software
2009-03-26 18:12 . 2009-03-29 00:58 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2009-03-25 23:47 . 2009-03-29 11:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\WinZip
2009-03-25 21:28 . 2009-03-25 21:28 <DIR> d-------- c:\program files\Common Files\AVSMedia
2009-03-25 21:28 . 2009-03-25 21:28 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\AVS4YOU
2009-03-25 21:27 . 2009-03-28 01:18 <DIR> d-------- c:\program files\AVS4YOU
2009-03-25 18:41 . 2009-03-25 18:41 <DIR> d-------- c:\program files\DVDVideoSoft
2009-03-25 18:41 . 2009-03-25 18:41 <DIR> d-------- c:\program files\Common Files\DVDVideoSoft
2009-03-25 18:41 . 2002-01-05 15:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2009-03-25 00:26 . 2009-03-25 00:26 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Windows Search
2009-03-24 19:22 . 2009-03-24 19:22 <DIR> d--hs---- c:\documents and settings\Mirek\PrivacIE
2009-03-24 19:22 . 2009-03-24 19:22 <DIR> d--hs---- c:\documents and settings\Mirek\IECompatCache
2009-03-24 19:21 . 2009-03-24 19:21 <DIR> d--hs---- c:\documents and settings\Mirek\IETldCache
2009-03-24 19:21 . 2009-03-24 19:21 <DIR> d--hs---- c:\documents and settings\LocalService\IETldCache
2009-03-24 19:19 . 2009-03-24 19:19 <DIR> d-------- c:\windows\ie8updates
2009-03-24 19:18 . 2009-03-24 19:19 <DIR> d--h-c--- c:\windows\ie8
2009-03-24 19:17 . 2009-02-28 06:55 105,984 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-03-24 18:29 . 2008-04-14 01:15 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-24 18:29 . 2008-04-14 01:15 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-24 12:00 . 2009-01-09 21:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-03-24 11:28 . 2009-03-31 11:33 <DIR> dr-h----- c:\documents and settings\Mirek\Data aplikací
2009-03-24 11:22 . 2009-03-24 11:22 479 --a------ c:\windows\system32\BIN_STRSBW.SPT
2009-03-24 10:46 . 2009-03-24 10:46 <DIR> d-------- c:\program files\ICQ6Toolbar
2009-03-24 10:46 . 2009-03-24 10:46 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ICQ
2009-03-24 10:45 . 2009-03-24 23:53 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\ICQ
2009-03-24 10:44 . 2009-03-24 10:49 <DIR> d-------- c:\program files\ICQ6.5
2009-03-24 02:27 . 2006-06-29 14:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-24 02:23 . 2009-03-24 02:23 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-24 02:23 . 2009-03-24 02:23 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-24 02:23 . 2009-03-24 02:23 <DIR> d-------- c:\program files\MSBuild
2009-03-24 02:22 . 2008-07-06 14:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-03-24 02:22 . 2008-07-06 14:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-03-24 02:22 . 2008-07-06 12:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-24 02:22 . 2008-07-06 14:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-03-24 02:22 . 2008-07-06 14:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-24 02:22 . 2008-07-06 14:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-03-24 02:22 . 2008-07-06 14:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-24 02:20 . 2009-03-29 23:11 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-03-24 02:20 . 2009-03-24 02:20 <DIR> d-------- c:\program files\Windows Desktop Search
2009-03-24 02:20 . 2009-03-24 02:20 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Windows Desktop Search
2009-03-24 02:19 . 2009-03-24 02:19 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-03-24 02:19 . 2008-03-07 19:02 192,000 -----c--- c:\windows\system32\dllcache\offfilt.dll
2009-03-24 02:19 . 2008-03-07 19:02 98,304 -----c--- c:\windows\system32\dllcache\nlhtml.dll
2009-03-24 02:19 . 2008-03-07 19:02 29,696 -----c--- c:\windows\system32\dllcache\mimefilt.dll
2009-03-24 02:18 . 2009-03-24 02:18 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-24 02:18 . 2009-03-24 11:22 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-03-24 02:17 . 2009-03-24 02:17 <DIR> d-------- c:\windows\system32\URTTemp
2009-03-24 01:04 . 2009-03-24 01:11 <DIR> d-------- c:\program files\Kdo je kdo 2.3.1
2009-03-24 00:51 . 2009-03-24 00:52 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\PC Suite
2009-03-24 00:51 . 2009-03-24 00:53 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Nokia
2009-03-24 00:51 . 2009-03-24 11:21 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\PC Suite
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\PC Connectivity Solution
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\Nokia
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\DIFX
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\Common Files\PCSuite
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\Common Files\Nokia
2009-03-24 00:50 . 2008-09-15 08:56 91,136 --a------ c:\windows\system32\nmwcdcls.dll
2009-03-24 00:50 . 2008-08-26 10:26 18,816 --a------ c:\windows\system32\drivers\pccsmcfd.sys
2009-03-24 00:49 . 2009-03-24 00:49 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Installations
2009-03-24 00:44 . 2009-03-24 00:47 <DIR> d-------- c:\program files\CCleaner
2009-03-24 00:16 . 2009-03-30 17:51 <DIR> d-------- c:\program files\Krtecek
2009-03-23 23:47 . 2009-03-23 23:47 <DIR> d-------- c:\program files\ESET
2009-03-23 23:47 . 2009-03-23 23:47 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ESET
2009-03-23 23:28 . 2009-03-23 23:28 <DIR> d-------- c:\documents and settings\Mirek\Bluetooth Software
2009-03-23 23:28 . 2008-04-14 09:51 21,504 --a------ c:\windows\system32\hidserv.dll
2009-03-23 23:28 . 2008-04-14 09:51 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-03-23 23:27 . 2008-04-14 08:59 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-03-23 23:27 . 2008-04-14 08:59 14,592 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-03-23 23:27 . 2001-10-24 12:54 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2009-03-23 23:27 . 2001-10-24 12:54 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2009-03-23 23:26 . 2009-03-23 23:26 <DIR> d-------- c:\program files\WIDCOMM
2009-03-23 23:24 . 2006-06-07 10:54 77,824 -ra------ c:\windows\system32\btw_ci.dll
2009-03-23 23:24 . 2006-06-07 17:26 67,384 --a------ c:\windows\system32\drivers\btwusb.sys
2009-03-23 23:18 . 2009-03-23 23:18 <DIR> d-------- c:\program files\Common Files\snpstd2
2009-03-23 23:07 . 2008-10-16 03:03 1,499,648 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-03-23 23:07 . 2009-03-08 05:34 1,206,784 --a--c--- c:\windows\system32\dllcache\urlmon.dll
2009-03-23 23:07 . 2009-03-08 05:34 914,944 --a--c--- c:\windows\system32\dllcache\wininet.dll
2009-03-23 23:07 . 2008-06-14 19:35 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-31 08:39 23,052 ----a-w c:\windows\system32\ctfmon.exe
2009-03-30 20:49 --------- d-----w c:\documents and settings\Mirek\Data aplikací\Skype
2009-03-30 15:27 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-30 15:22 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-30 15:19 --------- d-----w c:\documents and settings\Mirek\Data aplikací\skypePM
2009-03-23 20:44 --------- d-----w c:\program files\totalcmd
2009-03-23 20:13 --------- d-----w c:\program files\Common Files\Skype
2009-03-23 20:13 --------- d-----w c:\documents and settings\All Users\Data aplikací\Skype
2009-03-23 20:13 --------- d-----r c:\program files\Skype
2009-03-23 19:36 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-23 19:36 --------- d-----w c:\program files\Sun
2009-03-23 19:36 --------- d-----w c:\program files\Java
2009-03-23 19:34 315,392 ----a-w c:\windows\HideWin.exe
2009-03-23 19:34 --------- d-----w c:\program files\Realtek
2009-03-23 19:23 558,142 ----a-w c:\windows\java\Packages\SSB7XZH7.ZIP
2009-03-23 19:23 155,995 ----a-w c:\windows\java\Packages\VT33NZHJ.ZIP
2009-03-23 19:23 --------- d-----w c:\program files\microsoft frontpage
2009-03-08 03:34 914,944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 03:34 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 03:33 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 03:33 18,944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 03:32 72,704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 03:32 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 03:31 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 03:31 45,568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 03:31 34,816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 03:22 156,160 ----a-w c:\windows\system32\msls31.dll
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-01-11 13:22 9,715,200 ----a-w c:\windows\RTLCPL.exe
2009-01-11 13:22 86,016 ----a-w c:\windows\SoundMan.exe
2009-01-11 13:22 69,632 ----a-w c:\windows\Alcmtr.exe
2009-01-11 13:22 520,192 ----a-w c:\windows\RtlExUpd.dll
2009-01-11 13:22 49,152 ----a-w c:\windows\system32\ChCfg.exe
2009-01-11 13:22 2,808,832 ----a-w c:\windows\alcwzrd.exe
2009-01-11 13:22 2,162,688 ----a-w c:\windows\MicCal.exe
2009-01-11 13:22 16,342,528 ----a-w c:\windows\RTHDCPL.exe
2009-01-11 13:22 1,826,816 ----a-w c:\windows\SkyTel.exe
2009-01-11 13:22 1,191,936 ----a-w c:\windows\RtlUpd.exe
2009-01-07 17:20 265,720 ----a-w c:\windows\system32\msdbg2.dll
2009-01-07 17:20 26,144 ----a-w c:\windows\system32\spupdsvc.exe
2009-01-07 17:20 26,112 ----a-w c:\windows\system32\idndl.dll
2009-01-07 17:20 24,576 ----a-w c:\windows\system32\nlsdl.dll
2009-01-07 17:20 23,552 ----a-w c:\windows\system32\normaliz.dll
2008-12-05 06:57 144,896 ----a-w c:\windows\system32\schannel.dll
.

------- Sigcheck -------

2004-08-17 16:49 15360 a5baa91475167161dea02ba3c4ca4f59 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 09:52 15360 a756b8f0f7bafba6dfe39f7d169f2519 c:\windows\ServicePackFiles\i386\ctfmon.exe
2009-03-31 10:39 23052 7926f0ec0db740b143d36929090d4151 c:\windows\system32\ctfmon.exe
2008-04-14 09:52 15360 a756b8f0f7bafba6dfe39f7d169f2519 c:\windows\system32\dllcache\ctfmon.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2009-03-31 23052]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Mirek"="c:\documents and settings\Mirek\Mirek.exe" [BU]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2009-03-31 23052]
"WEBTRAN"="" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-23 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-01 5562368]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-04-01 86016]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2008-12-04 182936]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2008-12-04 957024]
"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-11 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2005-04-01 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2009-03-31 23052]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 553021]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-03-29 79872]
S0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-03-29 33408]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [2009-03-29 67808]
S2 fips32cup;fips32cup;\??\c:\windows\system32\drivers\fips32cup.sys --> c:\windows\system32\drivers\fips32cup.sys [?]
S2 netsik;netsik;\??\c:\windows\system32\drivers\netsik.sys --> c:\windows\system32\drivers\netsik.sys [?]
S2 securentm;securentm;\??\c:\windows\system32\drivers\securentm.sys --> c:\windows\system32\drivers\securentm.sys [?]
S2 systemntmi;systemntmi;c:\windows\system32\drivers\systemntmi.sys [2000-09-07 30464]
S2 ws2_32sik;ws2_32sik;\??\c:\windows\system32\drivers\ws2_32sik.sys --> c:\windows\system32\drivers\ws2_32sik.sys [?]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2009-03-29 84608]
S3 FileObjInfo;STFileDriver;\??\c:\documents and settings\All Users\Data aplikací\Spyware Terminator\FileObjInfo.sys --> c:\documents and settings\All Users\Data aplikací\Spyware Terminator\FileObjInfo.sys [?]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [2009-03-29 55904]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\DRIVERS\PAC7302.SYS --> c:\windows\system32\DRIVERS\PAC7302.SYS [?]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-08-29 69120]
S3 ZSMC0305;VIMICRO PC Camera 301DY;c:\windows\system32\drivers\usbVM305.sys [2009-03-30 391688]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [2009-03-29 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [2009-03-29 25184]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-31 11:58:03
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY
*]
"DisplayName"="???\17?\11\09"
"DeviceDesc"="???\17?\11\09"
"ProviderName"="???\11?\17?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"d:\\instalace\\záloha ovladače\\motherboard_driver_chipset_ati_rs690\\smbus\\smbusati.inf\00"
.
Celkový čas: 2009-03-31 11:59:57
ComboFix-quarantined-files.txt 2009-03-31 09:59:56
ComboFix2.txt 2009-03-31 09:37:15

Před spuštěním: Volných bajtů: 71 869 595 648
Po spuštění: Volných bajtů: 71,857,913,856

287 --- E O F --- 2009-03-24 16:46:16

[jaro3]

V normálním režimu:
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

sc config fips32cup start= disabled
sc stop fips32cup
sc delete fips32cup
sc config netsik start= disabled
sc stop netsik
sc delete netsik
sc config securentm start= disabled
sc stop securentm
sc delete securentm
sc config systemntmi start= disabled
sc stop systemntmi
sc delete systemntmi
sc config ws2_32sik start= disabled
sc stop ws2_32sik
sc delete ws2_32sik
sc config FileObjInfo start= disabled
sc stop FileObjInfo
sc delete FileObjInfo


ulož si ho na plochu jako-název remove.bat a ulož ho jako typ všechny soubory , najdi na ploše tento soubor , spusť ho poklepáním.Otevře se Dosovské okno a zavře. Restartuj comp.
*****************************************************************************************************************************************
V normálním režimu( vypni ochrany+firewall):
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\XXLGSC

Folder::
c:\windows\XXLGSC

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mirek"=-


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
c:\windows\java\Packages\SSB7XZH7.ZIP
c:\windows\java\Packages\VT33NZHJ.ZIP
Vlož sem pak odkazy výsledků.

[miruska27]

Jaro, děkuji ti a posílám ti další logy...

Virus total1


Soubor SSB7XZH7.ZIP přijatý 2009.03.31 17:19:03 (CET)Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.03.31 -
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 -
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.30 -
Avast 4.8.1335.0 2009.03.30 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 -
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.30 -
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 -
K7AntiVirus 7.10.685 2009.03.30 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5569 2009.03.30 -
McAfee+Artemis 5569 2009.03.30 -
McAfee-GW-Edition 6.7.6 2009.03.31 -
Microsoft 1.4502 2009.03.31 -
NOD32 3977 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 -
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 -
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 -
Sunbelt 3.2.1858.2 2009.03.31 -
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 -
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 -

Rozšiřující informace
File size: 558142 bytes
MD5...: cd82587e344eb1c9fc46ba77b33d4b76
SHA1..: aa76970160ecc6b7a7d40cde5875d39c2e4a19f3
SHA256: 9b447d0b33ed257343c562621517cb7973214f116efdcab612e68b8d4d8b54a4
SHA512: 140d2690c5bd194fa16fadc95c9c7079e039d7ae8348bc6d275da542615d8453<BR>ae03e94f6ef21de9bea6e8657a0c1412c8a295fb529831b39b61ee6f5087b6b5
ssdeep: 6144:yz2umuFjHPIn+W36HOWYZQFpepjGt+SyuLOT5vgQCnQPqxcPIBx/QEbmsoB<BR>LjiOW:AIigP9+<BR>
PEiD..: -
TrID..: File type identification<BR>ZIP compressed archive (100.0%)
PEInfo: -
RDS...: NSRL Reference Data Set<BR><BR>( Compaq )<BR><BR>&gt; Compaq Operating System CD: 8XZVR571.ZIP<BR><BR>

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.03.31 -
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 -
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.30 -
Avast 4.8.1335.0 2009.03.30 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 -
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.30 -
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 -
K7AntiVirus 7.10.685 2009.03.30 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5569 2009.03.30 -
McAfee+Artemis 5569 2009.03.30 -
McAfee-GW-Edition 6.7.6 2009.03.31 -
Microsoft 1.4502 2009.03.31 -
NOD32 3977 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 -
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 -
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 -
Sunbelt 3.2.1858.2 2009.03.31 -
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 -
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 -

Rozšiřující informace
File size: 558142 bytes
MD5...: cd82587e344eb1c9fc46ba77b33d4b76
SHA1..: aa76970160ecc6b7a7d40cde5875d39c2e4a19f3
SHA256: 9b447d0b33ed257343c562621517cb7973214f116efdcab612e68b8d4d8b54a4
SHA512: 140d2690c5bd194fa16fadc95c9c7079e039d7ae8348bc6d275da542615d8453<BR>ae03e94f6ef21de9bea6e8657a0c1412c8a295fb529831b39b61ee6f5087b6b5
ssdeep: 6144:yz2umuFjHPIn+W36HOWYZQFpepjGt+SyuLOT5vgQCnQPqxcPIBx/QEbmsoB<BR>LjiOW:AIigP9+<BR>
PEiD..: -
TrID..: File type identification<BR>ZIP compressed archive (100.0%)
PEInfo: -
RDS...: NSRL Reference Data Set<BR><BR>( Compaq )<BR><BR>&gt; Compaq Operating System CD: 8XZVR571.ZIP<BR><BR>


Virus total2


Soubor VT33NZHJ.ZIP přijatý 2009.03.31 17:28:40 (CET)Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.03.31 -
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 -
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.30 -
Avast 4.8.1335.0 2009.03.30 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 -
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.30 -
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 -
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5569 2009.03.30 -
McAfee+Artemis 5569 2009.03.30 -
McAfee-GW-Edition 6.7.6 2009.03.31 -
Microsoft 1.4502 2009.03.31 -
NOD32 3977 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 -
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 -
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 -
Sunbelt 3.2.1858.2 2009.03.31 -
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 -

Rozšiřující informace
File size: 155995 bytes
MD5...: d3c3efcb8ce5fc802b18d65dc47217ad
SHA1..: 27f3c0821836fe1d53f4b44b36360414fb7f5392
SHA256: 8ad2efc5f2521f731bb9df5e44bf5cd17a540c6efc4a365981faab96197a3eb4
SHA512: bfd637963d78b41aa82d3dbdbdee1fe28b0525126982a91b68af9a1c8797e4c3<BR>5a111a086da9553a9955fe956c3abc4d998ba34dcc71498f8c946996e1e761fb
ssdeep: 1536:pPGua5cdJJdCXWAMisHbaUDNqiO/7Ag05WYvavcvG6WYuA/eCk5tfgUDNR/<BR>5z0OU:2+3KIuGl3vQAmR/WytAS+YM9<BR>
PEiD..: -
TrID..: File type identification<BR>ZIP compressed archive (100.0%)
PEInfo: -
RDS...: NSRL Reference Data Set<BR><BR>( Compaq )<BR><BR>&gt; Compaq Operating System CD: NLZ97VTB.ZIP<BR><BR>




combofix


ComboFix 09-03-30.04 - Mirek 2009-03-31 17:12:41.2 - NTFSx86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1795 [GMT 2:00]
Spuštěný z: c:\documents and settings\Mirek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Mirek\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated)
FW: F-Secure Profi Antivirus 8.01 *disabled*

FILE ::
c:\windows\XXLGSC
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\XXLGSC

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-02-28 do 2009-03-31 )))))))))))))))))))))))))))))))
.

2009-03-30 21:00 . 2009-03-30 21:00 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-30 21:00 . 2009-03-30 21:00 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Malwarebytes
2009-03-30 21:00 . 2009-03-30 21:00 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-30 21:00 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-30 21:00 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-30 18:59 . 2009-03-30 18:59 <DIR> d-------- c:\program files\Trend Micro
2009-03-30 18:56 . 2009-03-31 17:04 23,052 --a------ c:\windows\vm305_sti.exe vimicro usb pc camera (zc0305)
2009-03-30 18:56 . 2009-03-30 18:56 23,052 --a------ c:\windows\vm305_sti .exe
2009-03-30 17:27 . 2009-03-30 17:27 <DIR> d-------- c:\windows\EffectResources
2009-03-30 17:27 . 2009-03-30 17:27 <DIR> d-------- c:\windows\CatRoot
2009-03-30 17:27 . 2009-03-30 17:27 <DIR> d-------- c:\program files\Vimicro
2009-03-30 17:27 . 2006-05-08 10:24 391,688 --a------ c:\windows\system32\drivers\usbVM305.sys
2009-03-30 17:27 . 2000-10-31 12:00 307,200 --a------ c:\windows\vidcap32.Exe
2009-03-30 17:27 . 2005-05-03 15:51 176,128 --a------ c:\windows\amcap.exe
2009-03-30 17:27 . 2005-11-08 11:37 155,722 --a------ c:\windows\system32\VM305Prp.Ax
2009-03-30 17:27 . 2005-08-08 16:36 114,688 --a------ c:\windows\VM305Cap.exe
2009-03-30 17:27 . 2005-08-05 18:36 81,920 --a------ c:\windows\system32\VM305STI.dll
2009-03-30 17:27 . 2005-08-05 15:15 61,440 --a------ c:\windows\VM305_STI.EXE
2009-03-30 17:27 . 2005-05-02 16:45 53,248 --a------ c:\windows\Sti305.exe
2009-03-29 22:48 . 2009-03-29 22:48 <DIR> d-------- C:\Phenomedia AG
2009-03-29 18:18 . 2009-03-30 10:46 2,686 --a------ c:\windows\TRNCOM.INI
2009-03-29 18:15 . 2009-03-29 18:18 <DIR> d-------- C:\TRANSLAT
2009-03-29 18:15 . 2009-03-31 17:04 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\LangSoft
2009-03-29 18:11 . 2009-03-29 22:58 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\LangSoft
2009-03-29 12:34 . 2009-03-30 21:11 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\F-Secure
2009-03-29 12:32 . 2008-12-04 15:57 79,872 --a------ c:\windows\system32\drivers\fsdfw.sys
2009-03-29 12:32 . 2009-03-29 12:46 33,408 --a------ c:\windows\system32\drivers\fsbts.sys
2009-03-29 12:31 . 2009-03-31 15:04 <DIR> d-------- c:\program files\F-Secure
2009-03-29 12:26 . 2009-03-29 12:30 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\fssg
2009-03-29 12:25 . 2009-03-29 12:31 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\f-secure
2009-03-29 11:20 . 2009-03-29 11:20 <DIR> d--hs---- c:\documents and settings\NetworkService\PrivacIE
2009-03-29 11:20 . 2009-03-29 11:20 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache
2009-03-29 11:00 . 2009-03-29 11:00 <DIR> dr------- c:\documents and settings\NetworkService\Oblíbené položky
2009-03-29 00:22 . 2009-03-29 00:22 <DIR> d-------- c:\program files\VSO
2009-03-29 00:22 . 2006-05-20 17:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2009-03-29 00:22 . 2006-05-11 20:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2009-03-29 00:22 . 2006-09-29 13:24 217,127 --a------ c:\windows\system32\drv43260.dll
2009-03-29 00:22 . 2006-09-29 13:25 208,935 --a------ c:\windows\system32\drv33260.dll
2009-03-29 00:22 . 2006-09-29 13:26 176,165 --a------ c:\windows\system32\drv23260.dll
2009-03-29 00:22 . 2002-12-10 03:20 102,439 --a------ c:\windows\system32\sipr3260.dll
2009-03-29 00:22 . 2007-03-18 21:37 65,602 --a------ c:\windows\system32\cook3260.dll
2009-03-28 13:15 . 2009-03-28 13:15 <DIR> d-------- c:\windows\CtDrvInstall
2009-03-28 13:15 . 2009-03-28 13:15 <DIR> d-------- C:\Live! Cam
2009-03-27 22:55 . 2009-03-27 22:55 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\PC Drivers HeadQuarters
2009-03-27 22:52 . 2009-03-28 13:57 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\GetRightToGo
2009-03-27 19:53 . 2009-03-27 19:53 <DIR> d-------- c:\documents and settings\LocalService\Bluetooth Software
2009-03-26 18:12 . 2009-03-29 00:58 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2009-03-25 23:47 . 2009-03-29 11:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\WinZip
2009-03-25 21:28 . 2009-03-25 21:28 <DIR> d-------- c:\program files\Common Files\AVSMedia
2009-03-25 21:28 . 2009-03-25 21:28 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\AVS4YOU
2009-03-25 21:27 . 2009-03-28 01:18 <DIR> d-------- c:\program files\AVS4YOU
2009-03-25 18:41 . 2009-03-25 18:41 <DIR> d-------- c:\program files\DVDVideoSoft
2009-03-25 18:41 . 2009-03-25 18:41 <DIR> d-------- c:\program files\Common Files\DVDVideoSoft
2009-03-25 18:41 . 2002-01-05 15:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2009-03-25 00:26 . 2009-03-25 00:26 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Windows Search
2009-03-24 19:22 . 2009-03-24 19:22 <DIR> d--hs---- c:\documents and settings\Mirek\PrivacIE
2009-03-24 19:22 . 2009-03-24 19:22 <DIR> d--hs---- c:\documents and settings\Mirek\IECompatCache
2009-03-24 19:21 . 2009-03-24 19:21 <DIR> d--hs---- c:\documents and settings\Mirek\IETldCache
2009-03-24 19:21 . 2009-03-24 19:21 <DIR> d--hs---- c:\documents and settings\LocalService\IETldCache
2009-03-24 19:19 . 2009-03-24 19:19 <DIR> d-------- c:\windows\ie8updates
2009-03-24 19:18 . 2009-03-24 19:19 <DIR> d--h-c--- c:\windows\ie8
2009-03-24 19:17 . 2009-02-28 06:55 105,984 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-03-24 18:29 . 2008-04-14 01:15 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-24 18:29 . 2008-04-14 01:15 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-24 12:00 . 2009-01-09 21:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-03-24 11:28 . 2009-03-31 11:33 <DIR> dr-h----- c:\documents and settings\Mirek\Data aplikací
2009-03-24 11:22 . 2009-03-24 11:22 479 --a------ c:\windows\system32\BIN_STRSBW.SPT
2009-03-24 10:46 . 2009-03-24 10:46 <DIR> d-------- c:\program files\ICQ6Toolbar
2009-03-24 10:46 . 2009-03-24 10:46 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ICQ
2009-03-24 10:45 . 2009-03-24 23:53 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\ICQ
2009-03-24 10:44 . 2009-03-24 10:49 <DIR> d-------- c:\program files\ICQ6.5
2009-03-24 02:27 . 2006-06-29 14:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-24 02:23 . 2009-03-24 02:23 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-24 02:23 . 2009-03-24 02:23 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-24 02:23 . 2009-03-24 02:23 <DIR> d-------- c:\program files\MSBuild
2009-03-24 02:22 . 2008-07-06 14:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-03-24 02:22 . 2008-07-06 14:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-03-24 02:22 . 2008-07-06 12:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-24 02:22 . 2008-07-06 14:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-03-24 02:22 . 2008-07-06 14:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-24 02:22 . 2008-07-06 14:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-03-24 02:22 . 2008-07-06 14:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-24 02:20 . 2009-03-29 23:11 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-03-24 02:20 . 2009-03-24 02:20 <DIR> d-------- c:\program files\Windows Desktop Search
2009-03-24 02:20 . 2009-03-24 02:20 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Windows Desktop Search
2009-03-24 02:19 . 2009-03-24 02:19 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-03-24 02:19 . 2008-03-07 19:02 192,000 -----c--- c:\windows\system32\dllcache\offfilt.dll
2009-03-24 02:19 . 2008-03-07 19:02 98,304 -----c--- c:\windows\system32\dllcache\nlhtml.dll
2009-03-24 02:19 . 2008-03-07 19:02 29,696 -----c--- c:\windows\system32\dllcache\mimefilt.dll
2009-03-24 02:18 . 2009-03-24 02:18 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-24 02:18 . 2009-03-24 11:22 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-03-24 02:17 . 2009-03-24 02:17 <DIR> d-------- c:\windows\system32\URTTemp
2009-03-24 01:04 . 2009-03-24 01:11 <DIR> d-------- c:\program files\Kdo je kdo 2.3.1
2009-03-24 00:51 . 2009-03-24 00:52 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\PC Suite
2009-03-24 00:51 . 2009-03-24 00:53 <DIR> d-------- c:\documents and settings\Mirek\Data aplikací\Nokia
2009-03-24 00:51 . 2009-03-24 11:21 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\PC Suite
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\PC Connectivity Solution
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\Nokia
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\DIFX
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\Common Files\PCSuite
2009-03-24 00:50 . 2009-03-24 00:50 <DIR> d-------- c:\program files\Common Files\Nokia
2009-03-24 00:50 . 2008-09-15 08:56 91,136 --a------ c:\windows\system32\nmwcdcls.dll
2009-03-24 00:50 . 2008-08-26 10:26 18,816 --a------ c:\windows\system32\drivers\pccsmcfd.sys
2009-03-24 00:49 . 2009-03-24 00:49 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Installations
2009-03-24 00:44 . 2009-03-24 00:47 <DIR> d-------- c:\program files\CCleaner
2009-03-24 00:16 . 2009-03-30 17:51 <DIR> d-------- c:\program files\Krtecek
2009-03-23 23:47 . 2009-03-23 23:47 <DIR> d-------- c:\program files\ESET
2009-03-23 23:47 . 2009-03-23 23:47 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ESET
2009-03-23 23:28 . 2009-03-23 23:28 <DIR> d-------- c:\documents and settings\Mirek\Bluetooth Software
2009-03-23 23:28 . 2008-04-14 09:51 21,504 --a------ c:\windows\system32\hidserv.dll
2009-03-23 23:28 . 2008-04-14 09:51 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-03-23 23:27 . 2008-04-14 08:59 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-03-23 23:27 . 2008-04-14 08:59 14,592 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-03-23 23:27 . 2001-10-24 12:54 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2009-03-23 23:27 . 2001-10-24 12:54 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
2009-03-23 23:26 . 2009-03-23 23:26 <DIR> d-------- c:\program files\WIDCOMM
2009-03-23 23:24 . 2006-06-07 10:54 77,824 -ra------ c:\windows\system32\btw_ci.dll
2009-03-23 23:24 . 2006-06-07 17:26 67,384 --a------ c:\windows\system32\drivers\btwusb.sys
2009-03-23 23:18 . 2009-03-23 23:18 <DIR> d-------- c:\program files\Common Files\snpstd2
2009-03-23 23:07 . 2008-10-16 03:03 1,499,648 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-03-23 23:07 . 2009-03-08 05:34 1,206,784 --a--c--- c:\windows\system32\dllcache\urlmon.dll
2009-03-23 23:07 . 2009-03-08 05:34 914,944 --a--c--- c:\windows\system32\dllcache\wininet.dll
2009-03-23 23:07 . 2008-06-14 19:35 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-03-23 23:06 . 2009-03-26 18:15 <DIR> d-------- c:\program files\DVDFab 5

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-31 08:39 23,052 ----a-w c:\windows\system32\ctfmon.exe
2009-03-30 20:49 --------- d-----w c:\documents and settings\Mirek\Data aplikací\Skype
2009-03-30 15:27 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-30 15:22 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-30 15:19 --------- d-----w c:\documents and settings\Mirek\Data aplikací\skypePM
2009-03-23 20:44 --------- d-----w c:\program files\totalcmd
2009-03-23 20:13 --------- d-----w c:\program files\Common Files\Skype
2009-03-23 20:13 --------- d-----w c:\documents and settings\All Users\Data aplikací\Skype
2009-03-23 20:13 --------- d-----r c:\program files\Skype
2009-03-23 19:36 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-23 19:36 --------- d-----w c:\program files\Sun
2009-03-23 19:36 --------- d-----w c:\program files\Java
2009-03-23 19:34 315,392 ----a-w c:\windows\HideWin.exe
2009-03-23 19:34 --------- d-----w c:\program files\Realtek
2009-03-23 19:23 558,142 ----a-w c:\windows\java\Packages\SSB7XZH7.ZIP
2009-03-23 19:23 155,995 ----a-w c:\windows\java\Packages\VT33NZHJ.ZIP
2009-03-23 19:23 --------- d-----w c:\program files\microsoft frontpage
2009-03-08 03:34 914,944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 03:34 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 03:33 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 03:33 18,944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 03:32 72,704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 03:32 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 03:31 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 03:31 45,568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 03:31 34,816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 03:22 156,160 ----a-w c:\windows\system32\msls31.dll
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-01-11 13:22 9,715,200 ----a-w c:\windows\RTLCPL.exe
2009-01-11 13:22 86,016 ----a-w c:\windows\SoundMan.exe
2009-01-11 13:22 69,632 ----a-w c:\windows\Alcmtr.exe
2009-01-11 13:22 520,192 ----a-w c:\windows\RtlExUpd.dll
2009-01-11 13:22 49,152 ----a-w c:\windows\system32\ChCfg.exe
2009-01-11 13:22 2,808,832 ----a-w c:\windows\alcwzrd.exe
2009-01-11 13:22 2,162,688 ----a-w c:\windows\MicCal.exe
2009-01-11 13:22 16,342,528 ----a-w c:\windows\RTHDCPL.exe
2009-01-11 13:22 1,826,816 ----a-w c:\windows\SkyTel.exe
2009-01-11 13:22 1,191,936 ----a-w c:\windows\RtlUpd.exe
2009-01-07 17:20 265,720 ----a-w c:\windows\system32\msdbg2.dll
2009-01-07 17:20 26,144 ----a-w c:\windows\system32\spupdsvc.exe
2009-01-07 17:20 26,112 ----a-w c:\windows\system32\idndl.dll
2009-01-07 17:20 24,576 ----a-w c:\windows\system32\nlsdl.dll
2009-01-07 17:20 23,552 ----a-w c:\windows\system32\normaliz.dll
2008-12-05 06:57 144,896 ----a-w c:\windows\system32\schannel.dll
.

------- Sigcheck -------

2004-08-17 16:49 15360 a5baa91475167161dea02ba3c4ca4f59 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 09:52 15360 a756b8f0f7bafba6dfe39f7d169f2519 c:\windows\ServicePackFiles\i386\ctfmon.exe
2009-03-31 10:39 23052 7926f0ec0db740b143d36929090d4151 c:\windows\system32\ctfmon.exe
2008-04-14 09:52 15360 a756b8f0f7bafba6dfe39f7d169f2519 c:\windows\system32\dllcache\ctfmon.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2009-03-31 23052]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2009-03-31 23052]
"WEBTRAN"="" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-23 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-01 5562368]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-04-01 86016]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2008-12-04 182936]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2008-12-04 957024]
"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-11 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2005-04-01 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2009-03-31 23052]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 553021]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-03-29 79872]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-08-29 69120]
S0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-03-29 33408]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [2009-03-29 67808]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2009-03-29 84608]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [2009-03-29 55904]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\DRIVERS\PAC7302.SYS --> c:\windows\system32\DRIVERS\PAC7302.SYS [?]
S3 ZSMC0305;VIMICRO PC Camera 301DY;c:\windows\system32\drivers\usbVM305.sys [2009-03-30 391688]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [2009-03-29 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [2009-03-29 25184]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-31 17:13:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY
*]
"DisplayName"="???\17?\11\09"
"DeviceDesc"="???\17?\11\09"
"ProviderName"="???\11?\17?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"d:\\instalace\\záloha ovladače\\motherboard_driver_chipset_ati_rs690\\smbus\\smbusati.inf\00"
.
Celkový čas: 2009-03-31 17:14:08
ComboFix-quarantined-files.txt 2009-03-31 15:14:07
ComboFix2.txt 2009-03-31 09:59:58
ComboFix3.txt 2009-03-31 09:37:15

Před spuštěním: Volných bajtů: 71 845 105 664
Po spuštění: Volných bajtů: 71,834,673,152

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

294 --- E O F --- 2009-03-24 16:46:16




HJT



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:36:44, on 31.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7598 bytes

[jaro3]

Ten HJT si mohl udělat v normálním režimu , ale mělo by to být jedno.
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Aktualizuj javu:
Java SE Runtime Environment 6u12
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u12-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
možná by si mohl zkusit defragmentaci HDD.
Pokud nejsou problémy , je to vše.